--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:58744","PortSpecifier":{"PortValue":58744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:58744","PortSpecifier":{"PortValue":58744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690145,"nanos":931761901},"http":{"id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47ebfe56-3132-40e0-af1d-1f35e6dd0215","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690145,"nanos":988729983},"http":{"id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3801f4f9-ee86-47e2-a278-ef0c5aa80202","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:58752","PortSpecifier":{"PortValue":58752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0a0b812-8c73-4a88-8605-6874f48102b8","method":"GET","path":"/maas-api/v1/api-keys/94c34cfc-9975-4dca-a4c5-c279808281f5","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:58752","PortSpecifier":{"PortValue":58752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690146,"nanos":45743710},"http":{"id":"c0a0b812-8c73-4a88-8605-6874f48102b8","method":"GET","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/94c34cfc-9975-4dca-a4c5-c279808281f5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/94c34cfc-9975-4dca-a4c5-c279808281f5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0a0b812-8c73-4a88-8605-6874f48102b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54332","PortSpecifier":{"PortValue":54332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab82df32-f53f-42c1-a561-09ac9b31905c","method":"GET","path":"/maas-api/v1/api-keys/4298c066-b118-431d-8916-8877c9c2e442","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54332","PortSpecifier":{"PortValue":54332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690146,"nanos":81965683},"http":{"id":"ab82df32-f53f-42c1-a561-09ac9b31905c","method":"GET","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/4298c066-b118-431d-8916-8877c9c2e442",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/4298c066-b118-431d-8916-8877c9c2e442",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab82df32-f53f-42c1-a561-09ac9b31905c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52592","PortSpecifier":{"PortValue":52592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b4daab4-71ff-4877-a969-a8ee8990658f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52592","PortSpecifier":{"PortValue":52592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690171,"nanos":669759362},"http":{"id":"1b4daab4-71ff-4877-a969-a8ee8990658f","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b4daab4-71ff-4877-a969-a8ee8990658f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:41804","PortSpecifier":{"PortValue":41804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:41804","PortSpecifier":{"PortValue":41804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690171,"nanos":701912696},"http":{"id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2399d82-82ae-476e-9a05-eff8d8c8be91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52604","PortSpecifier":{"PortValue":52604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52604","PortSpecifier":{"PortValue":52604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690171,"nanos":742838400},"http":{"id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","method":"GET","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Qppft6p1uyuiKGfd_UJFeXeTOMGitYncuqzdtsJdtFyddskHHMHa3UiscE9o"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Qppft6p1uyuiKGfd_UJFeXeTOMGitYncuqzdtsJdtFyddskHHMHa3UiscE9o\"}"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5972036d-bf41-49e2-b0ca-0f900d2aa613","keyName":"e2e-auth-iso-a-214237","subscription":"e2e-auth-iso-448ef8","tenant":"e2e-shared-a-7266ad","userId":"5972036d-bf41-49e2-b0ca-0f900d2aa613","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-448ef8"}
{"level":"info","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"555c0ad3-7b2a-40ab-b552-443625b9a2af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38924","PortSpecifier":{"PortValue":38924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38924","PortSpecifier":{"PortValue":38924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690199,"nanos":120132341},"http":{"id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4279790-7ed2-4b63-a791-9c8cc87f14c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35588","PortSpecifier":{"PortValue":35588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e07b633-f783-4e27-9973-b8e0d577bc38","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35588","PortSpecifier":{"PortValue":35588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690199,"nanos":158083722},"http":{"id":"1e07b633-f783-4e27-9973-b8e0d577bc38","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e07b633-f783-4e27-9973-b8e0d577bc38","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35600","PortSpecifier":{"PortValue":35600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35600","PortSpecifier":{"PortValue":35600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690199,"nanos":194795196},"http":{"id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","method":"GET","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6W2mYcslwVq3jsB_1nD7ob9hzqBkca3AyhmO87u5JjUo05g7NF4zQLlVxTD"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6W2mYcslwVq3jsB_1nD7ob9hzqBkca3AyhmO87u5JjUo05g7NF4zQLlVxTD\"}"}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-10T13:29:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0da80a86-bfb7-4641-8e99-8ec86dc41387","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42512","PortSpecifier":{"PortValue":42512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42512","PortSpecifier":{"PortValue":42512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690227,"nanos":611404954},"http":{"id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb4d35b3-79d0-4db3-8d5a-448a96ee9cef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:56402","PortSpecifier":{"PortValue":56402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:56402","PortSpecifier":{"PortValue":56402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690227,"nanos":650373699},"http":{"id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19823b03-8eb1-4917-ba6e-f0bd9d9d7129","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1926af20-6507-4d7b-859c-096aff52459c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42526","PortSpecifier":{"PortValue":42526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1926af20-6507-4d7b-859c-096aff52459c","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1926af20-6507-4d7b-859c-096aff52459c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42526","PortSpecifier":{"PortValue":42526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690227,"nanos":689401010},"http":{"id":"1926af20-6507-4d7b-859c-096aff52459c","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1926af20-6507-4d7b-859c-096aff52459c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1926af20-6507-4d7b-859c-096aff52459c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1926af20-6507-4d7b-859c-096aff52459c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1926af20-6507-4d7b-859c-096aff52459c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1926af20-6507-4d7b-859c-096aff52459c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:43396","PortSpecifier":{"PortValue":43396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:43396","PortSpecifier":{"PortValue":43396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690227,"nanos":785617227},"http":{"id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9701ac8e-83c7-454b-8b70-d1a924a11bea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35422","PortSpecifier":{"PortValue":35422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35422","PortSpecifier":{"PortValue":35422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690246,"nanos":647832553},"http":{"id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12d6bb98-8a85-42be-97cc-ac00eb7289b6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51632","PortSpecifier":{"PortValue":51632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e87ef3d-42de-465f-8880-bdcee25134f3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51632","PortSpecifier":{"PortValue":51632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690246,"nanos":684572835},"http":{"id":"4e87ef3d-42de-465f-8880-bdcee25134f3","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e87ef3d-42de-465f-8880-bdcee25134f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51648","PortSpecifier":{"PortValue":51648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","method":"GET","path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51648","PortSpecifier":{"PortValue":51648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690246,"nanos":720925588},"http":{"id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","method":"GET","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4392af75-acda-425c-bc56-0bdd9f9a89d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35424","PortSpecifier":{"PortValue":35424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","method":"GET","path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35424","PortSpecifier":{"PortValue":35424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690246,"nanos":748834774},"http":{"id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","method":"GET","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ed443a2d-4561-45bf-8875-9eaa2f1cf046",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:30:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f4d53a-e4cc-4158-80d8-6a436acd4b1d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57356","PortSpecifier":{"PortValue":57356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"480e6671-95a3-4ec2-9173-cfe510326d3f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57356","PortSpecifier":{"PortValue":57356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690274,"nanos":48647695},"http":{"id":"480e6671-95a3-4ec2-9173-cfe510326d3f","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"480e6671-95a3-4ec2-9173-cfe510326d3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48942","PortSpecifier":{"PortValue":48942}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48942","PortSpecifier":{"PortValue":48942}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690274,"nanos":82223778},"http":{"id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/auth-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"411bb3c3-3521-4408-8918-5e17bdb6fd03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57372","PortSpecifier":{"PortValue":57372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ca3d677-4448-4641-bbea-258b71ed021e","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57372","PortSpecifier":{"PortValue":57372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690274,"nanos":119032382},"http":{"id":"0ca3d677-4448-4641-bbea-258b71ed021e","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ySMXg1kxGrrhHYn4_LxJ7IVTMbzX7oy3WrCTfYvlYI6phatQrcrkr0ymYEsg"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ySMXg1kxGrrhHYn4_LxJ7IVTMbzX7oy3WrCTfYvlYI6phatQrcrkr0ymYEsg\"}"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60245645-3e36-4c71-a614-937df93a7ec6","keyName":"e2e-auth-iso-a-56656d","subscription":"e2e-auth-iso-ac7633","tenant":"e2e-shared-a-7266ad","userId":"60245645-3e36-4c71-a614-937df93a7ec6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/auth-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-ac7633"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:31:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ca3d677-4448-4641-bbea-258b71ed021e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aeeae0cfa02e7c3ce5826ddc2dc2c698d22b6f80b3f97123cfa979234fc16d7f"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cc96b87e83a521b5b0368396a5afbbbe7a0c7a2b33ec75214043099829a1dbe"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f5cdb26f437d07111e244ed3731cc64a855eb730e4b0da10ce0f02fe7e9f350f"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db0df9f9bcfd06af2d172a2170891c6fea8708a4099bcc082a11451f84b88e8b"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d7e70b1c4e0249eb758e2c4bd04449ed6f262d82785094895883c337d56af06"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4a8c5aa4c9bfcc054b4a686ba4214b66c68221e13f355de8f36b34838b0ac07"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/09fdbd8e29e4fce27b0a43194190074cf50d100a50c2a23cf7d0bcca3808d0dd"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7a01689f3d953f1f8a3d149f9b49bf22cca79460498607b505da4f0ce50f1d86"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ec205eded2cd6f56abd2278ba592e0b380acfc20408bc7c253a62a1ef01f66a"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8cab9f47dc8cd2fc8662330e7e47028cd6603be33baa3cdae620e476e125a0be"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87eadd9d2805e13f34a1a38c6c6dbda0a53d8f354589cb4912aa80f237714846"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60ef42cc77b436b9a82d1d9616774d563bbde265b11dab594d78bf9b48be4bce"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7ee96d2d50799af1d8786d8444d9e153c316a1a3cf55d8e8cb2a24411c11407"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0afa16efced345fed928f172affac68590db20d7bdffcde1eb43e333479aed35"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8e08ccf2051e5ec1833ab91aa6993019698724d91a0fda24107c9a567a3e7fb"}
{"level":"info","ts":"2026-07-10T13:31:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df831a7ef2695919a15fe77c88310a5672a57d4a752f3f54207eb40681d2ee16"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"debug","ts":"2026-07-10T13:31:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:31:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:31:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:31:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:31:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"info","ts":"2026-07-10T13:31:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"}
{"level":"error","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"error","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"info","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:32:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e"}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400"}
{"level":"debug","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f"}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"}
{"level":"info","ts":"2026-07-10T13:32:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37960","PortSpecifier":{"PortValue":37960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37960","PortSpecifier":{"PortValue":37960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690349,"nanos":223499453},"http":{"id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/sub-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fce910f2-e7c5-4381-b6ba-66cada9cf9ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44438","PortSpecifier":{"PortValue":44438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44438","PortSpecifier":{"PortValue":44438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690349,"nanos":278150464},"http":{"id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/sub-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6278e38a-1200-4128-a8c6-6a06c9e4e26c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37964","PortSpecifier":{"PortValue":37964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37964","PortSpecifier":{"PortValue":37964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690349,"nanos":325888331},"http":{"id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","method":"GET","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-etxAlTNLC4LuHhV5_YzuAenOOo9dwafRauNT2Kud9jqtHVETp6F9LbRJi0eS"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-etxAlTNLC4LuHhV5_YzuAenOOo9dwafRauNT2Kud9jqtHVETp6F9LbRJi0eS\"}"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"acd78651-3706-4046-88f2-a913a005c017","keyName":"e2e-sub-iso-f63dc5","subscription":"e2e-a-only-0472d7","tenant":"e2e-shared-a-7266ad","userId":"acd78651-3706-4046-88f2-a913a005c017","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/sub-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-0472d7"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"058bd514-82af-41a8-a3ba-b4cd8344ef65","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690349,"nanos":383193204},"http":{"id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","method":"GET","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5KMFAT4JQke5W4To_8NDfo1UyrtynSmOcLYa7BZIV45RB6pJHcc43duXDajD"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5KMFAT4JQke5W4To_8NDfo1UyrtynSmOcLYa7BZIV45RB6pJHcc43duXDajD\"}"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ed4c3397-10e5-4000-b80f-d349bf078fa5","keyName":"e2e-sub-iso-81a274","subscription":"e2e-b-only-0472d7","tenant":"e2e-shared-b-d5a846","userId":"ed4c3397-10e5-4000-b80f-d349bf078fa5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/sub-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-0472d7"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa5e0870-a6c7-47a8-ae28-e9ce6dd4d361","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57164","PortSpecifier":{"PortValue":57164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57164","PortSpecifier":{"PortValue":57164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690376,"nanos":493365439},"http":{"id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/sub-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8de3749-76cf-4d7b-a809-9c06c1e160c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35946","PortSpecifier":{"PortValue":35946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35946","PortSpecifier":{"PortValue":35946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690376,"nanos":532373879},"http":{"id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/sub-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35c53f42-83e4-4ddf-95b2-ed650638b1e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57172","PortSpecifier":{"PortValue":57172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:57172","PortSpecifier":{"PortValue":57172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690376,"nanos":564950826},"http":{"id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EwNqE2ohpN0d4WrL_6HoiDSvZEiyvzXulMrqe1MHGhmEMH7bFDBrRRXilvMr"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EwNqE2ohpN0d4WrL_6HoiDSvZEiyvzXulMrqe1MHGhmEMH7bFDBrRRXilvMr\"}"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9043c9f9-d8a5-4ed9-82c1-84dacbe7f7c4","keyName":"e2e-sub-iso-eaee3f","subscription":"e2e-shared-sub-2fcef7","tenant":"e2e-shared-a-7266ad","userId":"9043c9f9-d8a5-4ed9-82c1-84dacbe7f7c4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/sub-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-2fcef7"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f3f040c-3ef6-4ab7-b651-ee6b01bde977","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35962","PortSpecifier":{"PortValue":35962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"896ba523-ff97-4959-9683-9f0a79a274e7","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35962","PortSpecifier":{"PortValue":35962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690376,"nanos":971285929},"http":{"id":"896ba523-ff97-4959-9683-9f0a79a274e7","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TlstYTPP05CUwbzT_TkowEWKKZkHijuCGfXL0WX1DHBn8qKxcxYk6df8U6Ku"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TlstYTPP05CUwbzT_TkowEWKKZkHijuCGfXL0WX1DHBn8qKxcxYk6df8U6Ku\"}"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8606d0e7-483a-4e8e-9696-3fd1518f64e5","keyName":"e2e-sub-iso-350487","subscription":"e2e-shared-sub-2fcef7","tenant":"e2e-shared-b-d5a846","userId":"8606d0e7-483a-4e8e-9696-3fd1518f64e5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/sub-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-2fcef7"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:32:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"896ba523-ff97-4959-9683-9f0a79a274e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:33:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb64e06496d38f31993f879564cb07aaf22f56aa883b28afcdd04b35d03ee36c"}
{"level":"info","ts":"2026-07-10T13:33:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/958e8ba6a9541824a2c2416223a75efd9455305391acf62f3c78e10f745c4b3d"}
{"level":"info","ts":"2026-07-10T13:33:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7c0935d72717526792472bf96033cd5f12699650203864c193c48b318a8f08e"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6b24ed07a17301b52cc6fb275e52bacbd4bcc937ecf9849a5445ea600677f9d"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b3cf8450aeae280a4e99164b83ceef42890db2495e19bc8ae2ba9a1b14117f8"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77095e7a369eb9c61c46e11b59b4d225364fe543a88f22aacb118547a2de7093"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4725a725275a592d329cad35a41d625e288f955ee1431678534350b21d37e892"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a8743c755a8a60c1c9c4e5531e050f8d43bb6f2c776010a6265e99211f01391"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8222abc41e4e42901991e4debb816867bfc0220b3006f1add86e50ae0b5949f1"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4e679b86af00b96c54a6c38737329d66288655643bacdf550733b52a79b24b7"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccb377307b086cb3936680de0f6030c7c4d4b43bb0f7c76c80066df22280b5d7"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/399c2f14a9764f5bd904664243b810c52371229da802c0abf6a8af40ed2f1882"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc4db3665a40336027f5dc4c25bd83dcc312d952c90c8cf928c01dc8a9e2afe2"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cc95eae79b0a77bd50f22ca153af2af92c0c928bfa6ff22d7ea4b08dbc0a5d2f"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76657a0ea146bc99e14869feddc532bfd78f601064ed4b5387c78d22f0f77b44"}
{"level":"info","ts":"2026-07-10T13:33:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b3cdc2acbe34055598a3db3ff42b0ad7def9efb34190c5b7b2385e53ca95ac7"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"debug","ts":"2026-07-10T13:33:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:33:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:33:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"debug","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"}
{"level":"info","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T13:34:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"debug","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f"}
{"level":"info","ts":"2026-07-10T13:34:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39656","PortSpecifier":{"PortValue":39656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39656","PortSpecifier":{"PortValue":39656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690469,"nanos":802701478},"http":{"id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27229981-260f-44d8-842a-8ca018654267","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59230","PortSpecifier":{"PortValue":59230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27229981-260f-44d8-842a-8ca018654267","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27229981-260f-44d8-842a-8ca018654267","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59230","PortSpecifier":{"PortValue":59230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690469,"nanos":850030779},"http":{"id":"27229981-260f-44d8-842a-8ca018654267","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"27229981-260f-44d8-842a-8ca018654267","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27229981-260f-44d8-842a-8ca018654267","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27229981-260f-44d8-842a-8ca018654267","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27229981-260f-44d8-842a-8ca018654267","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690469,"nanos":903387745},"http":{"id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39672","PortSpecifier":{"PortValue":39672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d4929bec-5813-4049-90bd-055f204a4d65","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39672","PortSpecifier":{"PortValue":39672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690470,"nanos":963943034},"http":{"id":"d4929bec-5813-4049-90bd-055f204a4d65","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d4929bec-5813-4049-90bd-055f204a4d65","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4929bec-5813-4049-90bd-055f204a4d65","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4929bec-5813-4049-90bd-055f204a4d65","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39686","PortSpecifier":{"PortValue":39686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39686","PortSpecifier":{"PortValue":39686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690472,"nanos":1043424},"http":{"id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":508774193},"http":{"id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54134","PortSpecifier":{"PortValue":54134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54134","PortSpecifier":{"PortValue":54134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":547492964},"http":{"id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55084","PortSpecifier":{"PortValue":55084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55084","PortSpecifier":{"PortValue":55084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":580435303},"http":{"id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db40c707-6a26-401d-82b9-c0284c973086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db40c707-6a26-401d-82b9-c0284c973086","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db40c707-6a26-401d-82b9-c0284c973086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690487,"nanos":726979936},"http":{"id":"db40c707-6a26-401d-82b9-c0284c973086","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db40c707-6a26-401d-82b9-c0284c973086","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db40c707-6a26-401d-82b9-c0284c973086","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db40c707-6a26-401d-82b9-c0284c973086","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44432","PortSpecifier":{"PortValue":44432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"41f802a6-2b7a-4d72-a908-bd6430c71517","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44432","PortSpecifier":{"PortValue":44432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690488,"nanos":765455847},"http":{"id":"41f802a6-2b7a-4d72-a908-bd6430c71517","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53512","PortSpecifier":{"PortValue":53512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e2552b5-4fea-4210-a39e-86dfa329a165","method":"POST","path":"/ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846/v1/completions","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53512","PortSpecifier":{"PortValue":53512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690488,"nanos":800542208},"http":{"id":"6e2552b5-4fea-4210-a39e-86dfa329a165","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UqFs4GuoLDPwhtYV_JZoOwtec92kqwFcax8IIpCmigCJ4oUvDrMl9oYW98aH"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UqFs4GuoLDPwhtYV_JZoOwtec92kqwFcax8IIpCmigCJ4oUvDrMl9oYW98aH\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","keyName":"e2e-rate-b-db18bb","subscription":"e2e-rate-iso-b-db18bb","tenant":"e2e-shared-b-d5a846","userId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\",\"requestedSubscription\":\"e2e-rate-iso-b-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5a846","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-db18bb","namespace":"ai-tenant-e2e-shared-b-d5a846","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","keyName":"e2e-rate-b-db18bb","selected_subscription":"e2e-rate-iso-b-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-b-d5a846/e2e-rate-iso-b-db18bb@ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5a846","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-db18bb","namespace":"ai-tenant-e2e-shared-b-d5a846","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42798","PortSpecifier":{"PortValue":42798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42798","PortSpecifier":{"PortValue":42798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":116693903},"http":{"id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b91d596c-e91a-45bf-9657-259ac82ece96","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":169487678},"http":{"id":"b91d596c-e91a-45bf-9657-259ac82ece96","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89744474-0b31-4134-832b-ecb923251fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42822","PortSpecifier":{"PortValue":42822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89744474-0b31-4134-832b-ecb923251fed","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89744474-0b31-4134-832b-ecb923251fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42822","PortSpecifier":{"PortValue":42822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":584219116},"http":{"id":"89744474-0b31-4134-832b-ecb923251fed","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"89744474-0b31-4134-832b-ecb923251fed","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89744474-0b31-4134-832b-ecb923251fed","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89744474-0b31-4134-832b-ecb923251fed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89744474-0b31-4134-832b-ecb923251fed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42838","PortSpecifier":{"PortValue":42838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42838","PortSpecifier":{"PortValue":42838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":631155735},"http":{"id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42854","PortSpecifier":{"PortValue":42854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42854","PortSpecifier":{"PortValue":42854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":664998452},"http":{"id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":692993097},"http":{"id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"f72af042-0a4b-4949-a0b1-b0794952d7c4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":692993097,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42860","PortSpecifier":{"PortValue":42860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42860","PortSpecifier":{"PortValue":42860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":728988657},"http":{"id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":736873174},"http":{"id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"9b752a4b-e97f-4903-beb5-5cfb742259b0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":736873174,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42862","PortSpecifier":{"PortValue":42862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42862","PortSpecifier":{"PortValue":42862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":773504728},"http":{"id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":781068804},"http":{"id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"42e527a1-48ce-43d0-9e42-c07989cee150"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":781068804,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42872","PortSpecifier":{"PortValue":42872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42872","PortSpecifier":{"PortValue":42872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":812798550},"http":{"id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":820273676},"http":{"id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":820273676,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37428","PortSpecifier":{"PortValue":37428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a800cad-0163-439d-ba3c-dbadb3d45724","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37428","PortSpecifier":{"PortValue":37428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":32581616},"http":{"id":"6a800cad-0163-439d-ba3c-dbadb3d45724","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37430","PortSpecifier":{"PortValue":37430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37430","PortSpecifier":{"PortValue":37430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":64019468},"http":{"id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37434","PortSpecifier":{"PortValue":37434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37434","PortSpecifier":{"PortValue":37434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":92559123},"http":{"id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":99881860},"http":{"id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"6a6e187d-bab1-488d-a960-e1bf737bd68d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":99881860,"seconds":1783690510},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37446","PortSpecifier":{"PortValue":37446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37446","PortSpecifier":{"PortValue":37446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":132801218},"http":{"id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c51f6669-c420-4def-99b4-dac461537d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c51f6669-c420-4def-99b4-dac461537d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":139829997},"http":{"id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c51f6669-c420-4def-99b4-dac461537d19","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"c51f6669-c420-4def-99b4-dac461537d19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":139829997,"seconds":1783690510},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c51f6669-c420-4def-99b4-dac461537d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c51f6669-c420-4def-99b4-dac461537d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37448","PortSpecifier":{"PortValue":37448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c73f284a-6228-4860-9ab6-7edd5a54307b","method":"DELETE","path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37448","PortSpecifier":{"PortValue":37448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":176107556},"http":{"id":"c73f284a-6228-4860-9ab6-7edd5a54307b","method":"DELETE","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37460","PortSpecifier":{"PortValue":37460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a90d833a-5324-4e5b-abb9-58c1008fa817","method":"DELETE","path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37460","PortSpecifier":{"PortValue":37460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":210116405},"http":{"id":"a90d833a-5324-4e5b-abb9-58c1008fa817","method":"DELETE","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"info","ts":"2026-07-10T13:35:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8"}
{"level":"info","ts":"2026-07-10T13:35:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400"}
{"level":"info","ts":"2026-07-10T13:35:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"info","ts":"2026-07-10T13:35:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:35:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f"}
{"level":"info","ts":"2026-07-10T13:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}