--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c16739e4-6cea-42b3-91f6-1479a508b4ef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47948","PortSpecifier":{"PortValue":47948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"04d90f81-b329-455d-b3da-ea37d9708b34","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47948","PortSpecifier":{"PortValue":47948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014737,"nanos":377519525},"http":{"id":"04d90f81-b329-455d-b3da-ea37d9708b34","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/auth-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04d90f81-b329-455d-b3da-ea37d9708b34","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014737,"nanos":427186258},"http":{"id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9db254e0-5f2a-9fa2-8f84-051181c94c41","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47958","PortSpecifier":{"PortValue":47958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47958","PortSpecifier":{"PortValue":47958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014737,"nanos":467615764},"http":{"id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/auth-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ccd9140-ef74-43fe-bb7b-13e05a42fbd1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49686","PortSpecifier":{"PortValue":49686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49686","PortSpecifier":{"PortValue":49686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014754,"nanos":565428925},"http":{"id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d76e04bb-7d77-4c0a-aaa3-ccc6bfd2817d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b914377-acad-427a-b77d-982bf6ef7377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:48886","PortSpecifier":{"PortValue":48886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b914377-acad-427a-b77d-982bf6ef7377","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b914377-acad-427a-b77d-982bf6ef7377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:48886","PortSpecifier":{"PortValue":48886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014754,"nanos":610915838},"http":{"id":"0b914377-acad-427a-b77d-982bf6ef7377","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b914377-acad-427a-b77d-982bf6ef7377","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b914377-acad-427a-b77d-982bf6ef7377","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/auth-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b914377-acad-427a-b77d-982bf6ef7377","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b914377-acad-427a-b77d-982bf6ef7377","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b914377-acad-427a-b77d-982bf6ef7377","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:48888","PortSpecifier":{"PortValue":48888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","method":"GET","path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:48888","PortSpecifier":{"PortValue":48888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014754,"nanos":655718856},"http":{"id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","method":"GET","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/auth-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"882aef85-2355-46e9-9dc5-9f9d4309ab5b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49700","PortSpecifier":{"PortValue":49700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"55747d8f-2278-4823-9200-bfb6fa8040c9","method":"GET","path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49700","PortSpecifier":{"PortValue":49700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014754,"nanos":695649694},"http":{"id":"55747d8f-2278-4823-9200-bfb6fa8040c9","method":"GET","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/93646486-4ea4-49ad-a7f8-6941e69d80b6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55747d8f-2278-4823-9200-bfb6fa8040c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:58068","PortSpecifier":{"PortValue":58068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1131248-0216-48c9-89af-d529cf16f7fd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:58068","PortSpecifier":{"PortValue":58068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014771,"nanos":765894189},"http":{"id":"d1131248-0216-48c9-89af-d529cf16f7fd","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1131248-0216-48c9-89af-d529cf16f7fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:40988","PortSpecifier":{"PortValue":40988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:40988","PortSpecifier":{"PortValue":40988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014771,"nanos":807104299},"http":{"id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/auth-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff18ba8a-d81a-4fa3-ade1-b3f40f3dc5e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:58072","PortSpecifier":{"PortValue":58072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:58072","PortSpecifier":{"PortValue":58072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014771,"nanos":851174162},"http":{"id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-j3dA7CxChwQPz9JM_RAYPjjg8pV23EnHQUk4UsPThxbCXJwpAO7f3UuzHRTq"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-j3dA7CxChwQPz9JM_RAYPjjg8pV23EnHQUk4UsPThxbCXJwpAO7f3UuzHRTq\"}"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7468e58-c1d7-470a-af57-c7f9a00ac4e7","keyName":"e2e-auth-iso-a-43f560","subscription":"e2e-auth-iso-c10ef5","tenant":"e2e-shared-a-1381a9","userId":"d7468e58-c1d7-470a-af57-c7f9a00ac4e7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/auth-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-c10ef5"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:52:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7644ada8-9aea-4a14-bd9e-f5597aa33020","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:52:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bae1c4f5bc53df3056ac0fa76b9ac3556705b5806f3efe4e11c14c41dca23f5a"}
{"level":"info","ts":"2026-07-02T17:52:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f879680a62c82d227fea18714c663c5e93990332b2455554dfb02330d0a4e1f"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07c1c0e441e1a3594415049a79d6b57f57df66936846afa97f08a6cdb7c093dc"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bafb602768b74bfede59aadb523063ada5e401d20421581129b16552ef594d42"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d65e8b7e30a6727c4f261c6b97c21f5488963c67e5e99047ce5deb5eccf40e1e"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4705b2c050ef9336d460f0d535349763d38b45d479c82fdbea18ab5862e422a8"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/295e6e38f5d45e73a514a49bdbd24461c96b060ff84833ad920867742f5377ac"}
{"level":"info","ts":"2026-07-02T17:52:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe34aeb2ec9c872be9321f119f19a2cda64cf79389e998e7eb89faaf9de40d71"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e67535c61d63781aa96a3bb8ca750e96b46f500f951174d42336a7e652e3fc4b"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/43b3ce1c9ab642b776f1dbc39e587c7dee5104864e06823ce16f7ff489e89e7b"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ac28844c60adbdbf4ddd401276c80689f0817867b6b24387bf07c86171af4271"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2953a109db22c34b21ae249ba718ac5db5cb4ffd3c7f34520cec730719f1b501"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e023765cc6baf79a4921734686dcc4a175608c0851b132563fed5e9383fa5d6"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9e10b330be94e7ecb94d8979a6bc25475a0e60975ff8fb27877e007da4bcf4e"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f16db542e990ff3221d20bd59f48edb772ef70d3cbcbbf906fed44f6d867dfd7"}
{"level":"info","ts":"2026-07-02T17:53:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b44d8caa4c07f91a2cc18969bee5b31eb828fc0bfdc5b0bf9da8fc90cb448cdb"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5"}
{"level":"debug","ts":"2026-07-02T17:53:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"}
{"level":"debug","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:53:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"debug","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:53:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54742","PortSpecifier":{"PortValue":54742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54742","PortSpecifier":{"PortValue":54742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014830,"nanos":654713567},"http":{"id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/sub-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5c239cd-2c31-4957-8215-86b23e97e4e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:34976","PortSpecifier":{"PortValue":34976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:34976","PortSpecifier":{"PortValue":34976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014830,"nanos":698337960},"http":{"id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/sub-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cf5d9888-88eb-46c2-8c21-ed2b8a750cde","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47190","PortSpecifier":{"PortValue":47190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47190","PortSpecifier":{"PortValue":47190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014830,"nanos":741308643},"http":{"id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","method":"GET","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VpRH2erZMzMt50hB_nfGkPCHhRPe04JRFCRrp5KZkU8KN5jOcREa5O9AexSi"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VpRH2erZMzMt50hB_nfGkPCHhRPe04JRFCRrp5KZkU8KN5jOcREa5O9AexSi\"}"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"483748ab-9a68-4c56-a350-06f12936b3da","keyName":"e2e-sub-iso-281239","subscription":"e2e-a-only-ec6886","tenant":"e2e-shared-a-1381a9","userId":"483748ab-9a68-4c56-a350-06f12936b3da","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/sub-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-ec6886"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"236ba193-7bcb-4ecb-ad19-397d5b253a52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:34980","PortSpecifier":{"PortValue":34980}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:34980","PortSpecifier":{"PortValue":34980}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014830,"nanos":775371603},"http":{"id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","method":"GET","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-lo0QLrtRvbudXSUQ_lndVlaMqK4Lxtpkav39k5EMcRa28m1BS6sGhpqutoCX"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-lo0QLrtRvbudXSUQ_lndVlaMqK4Lxtpkav39k5EMcRa28m1BS6sGhpqutoCX\"}"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"76a1e415-e41a-4209-8ef4-3898cc9e1e4b","keyName":"e2e-sub-iso-d9ca86","subscription":"e2e-b-only-ec6886","tenant":"e2e-shared-b-d1bf18","userId":"76a1e415-e41a-4209-8ef4-3898cc9e1e4b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/sub-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-ec6886"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:53:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa045833-0db1-4d94-b1c3-6b4fe17fb75d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52058","PortSpecifier":{"PortValue":52058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32193559-14e7-43eb-a499-90e4fa47fc85","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52058","PortSpecifier":{"PortValue":52058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014840,"nanos":746432004},"http":{"id":"32193559-14e7-43eb-a499-90e4fa47fc85","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/sub-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32193559-14e7-43eb-a499-90e4fa47fc85","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4bece135-c220-419c-bed3-022a26d67f48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52268","PortSpecifier":{"PortValue":52268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4bece135-c220-419c-bed3-022a26d67f48","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4bece135-c220-419c-bed3-022a26d67f48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52268","PortSpecifier":{"PortValue":52268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014840,"nanos":790090009},"http":{"id":"4bece135-c220-419c-bed3-022a26d67f48","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4bece135-c220-419c-bed3-022a26d67f48","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4bece135-c220-419c-bed3-022a26d67f48","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/sub-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bece135-c220-419c-bed3-022a26d67f48","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4bece135-c220-419c-bed3-022a26d67f48","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4bece135-c220-419c-bed3-022a26d67f48","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52066","PortSpecifier":{"PortValue":52066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52066","PortSpecifier":{"PortValue":52066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014840,"nanos":829917892},"http":{"id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9NLCwwirES1uioc9_TUPtCUYRGfvMLzLbjc7mvle1jORc8wE3mKwzHOvGYcu"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9NLCwwirES1uioc9_TUPtCUYRGfvMLzLbjc7mvle1jORc8wE3mKwzHOvGYcu\"}"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"33de1945-0a5b-4189-84b7-f8d635d957b9","keyName":"e2e-sub-iso-e7eee8","subscription":"e2e-shared-sub-36525e","tenant":"e2e-shared-a-1381a9","userId":"33de1945-0a5b-4189-84b7-f8d635d957b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/sub-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-36525e"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b447415-76fd-4c96-8c51-4e64a0aedb41","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52274","PortSpecifier":{"PortValue":52274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"703c7a5d-b69f-4370-8ecc-f974311575c2","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52274","PortSpecifier":{"PortValue":52274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014840,"nanos":871618181},"http":{"id":"703c7a5d-b69f-4370-8ecc-f974311575c2","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1NDZX17zDYWvFlx7N_SwUEKXH2BenUT5xbtVsVttxMEf5kOnEF035UsioQzSR"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1NDZX17zDYWvFlx7N_SwUEKXH2BenUT5xbtVsVttxMEf5kOnEF035UsioQzSR\"}"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"53cd012d-2bc1-4aa6-b7f7-803c60d2bb53","keyName":"e2e-sub-iso-d71861","subscription":"e2e-shared-sub-36525e","tenant":"e2e-shared-b-d1bf18","userId":"53cd012d-2bc1-4aa6-b7f7-803c60d2bb53","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/sub-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-36525e"}
{"level":"info","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:54:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703c7a5d-b69f-4370-8ecc-f974311575c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:54:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5dfa15d2f33cf9ef34916c0eea9d12b582b8d2aef8a8b420ccc14c212c96c00"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64d3e85e7c9bf68abbc35ce1ae0e892ecc3def2362cbedcccf847c4082150bb5"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9ad6d4004f5310e609016175cb3e4cf428a7fe54a1f079594bd1976b840c8231"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0b44aa93c13d92a84eb973bff127022607fc0f968952dacf5de3b1da6578924"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0e802f6b43935e39e56a2fa2b420d8e37f63d651f56116581bc92c5f6e58bb8"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e2fbe52d2d96dce1bf0ea58052d9cbe7e25d32109b90ff00926d3ffe741f457"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10e815676df901513bf83fa840a23e4e10e5b9c45b50e0b7d98e4d08649f5abb"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c73d4818fdd93a5d01ee2a8fc4f54d3bdb6799495ad9ec70714008675f0cbe09"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7697d9f6c6f15e323fed88c310213302ee74a9262de2d467c4c8363402825c3"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d7b3e01c800661f4131f27c71d6f54ba2d4e8baa80533f08b32e0503f3ccbac8"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1ca87e238f0f80ee1a692a4370caec50b3a860a109e39f5e937da6252a3315b"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07f345b46624a393fc282e8cbac44423fda11adc530b5eb28083fdfb01d5d8c9"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f043dd3abb3230b2a1492ecac6787ac349caf7d89e5eec58c5f432f2c613b77d"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5319ab71099654f2b055db9aa1d866448f422d48c69794a8cb7d23e4f2e9906e"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e95b071813e0eda4e0713feca558e34601c246436c84266cea475a5c74680f1"}
{"level":"info","ts":"2026-07-02T17:54:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cf540fad5829aa30496d5f7fc900dc18e42d0a4d21675429ef9f79ce1114abe"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"debug","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"error","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:54:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:54:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"debug","ts":"2026-07-02T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/305bde7d554d0d2810b101d2b8d4e0e15521c2afbf16166555b8e9aa4ed39a3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e9607d3c9394ff787a7cb9306c470b1007979008e27c6d6c68281553a4653faa","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/30c4b39450ec876cfb2b0e66cbea2a74b7bcfafcf83d80a94c503487492e5a48","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/888fdad5bc63ac36546012ce97b2af4b7b1a45ef243fd2eba72f12c306f06e3e","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/707878bcd632125ecab845de29fc41570ff2eb882a04dea05a2e77c0ea6d31f9","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a394737442ca47bfbcb906bcf34d05c5515587984942470db6d6858608ab543a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4325b2a5e55bf181d1f503f5c3cbce3259c00ca301216d4ea5bc6b962627f1bd","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3774b789b89cb794db9f2ae5a4e410c6a000c480af86f9e4466977b4dc7de25a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d66f5b12bbb76f83ef1cb89313ae7356d9a4c974f276c1405eefa0cb8d66ceda","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c098209e055107073c6ded1d63e221315c2239f3cf17a7d15056a7494c5714fb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3d32277ea538e86091b57e14fc6f6582cbe1daa3e7e81223282a75b03a512083","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/47d4519f979dd8b06fb3b12ecf63e079887e8b64c789a1ff79b4c429f3a6aa2a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ef3f8313d73a7c14b76ea704cc3f23f015b2ab50034887cf570208a050e9863","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/101d9a4d9b715268b3a3623fb114473501068b7352d534f324f4a3121b535746","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98dd9311f361e75de96f77b800598c9f5c79c7fa539cfd493b5f7631f8efab90","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}
{"level":"debug","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725","issuerUrl":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:38920","PortSpecifier":{"PortValue":38920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67ac034a-2778-40c9-b82d-dee89f534a7c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:38920","PortSpecifier":{"PortValue":38920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014929,"nanos":605183175},"http":{"id":"67ac034a-2778-40c9-b82d-dee89f534a7c","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67ac034a-2778-40c9-b82d-dee89f534a7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014929,"nanos":650908949},"http":{"id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8e9722-4fd3-4d49-9aaa-0a084be77764","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:38934","PortSpecifier":{"PortValue":38934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:38934","PortSpecifier":{"PortValue":38934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014929,"nanos":696410416},"http":{"id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3\"}"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","subscription":"e2e-rate-iso-a-56441f","tenant":"e2e-shared-a-1381a9","userId":"164a29a7-8348-4801-8055-ed3f1f413523","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-56441f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-56441f"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","selected_subscription":"e2e-rate-iso-a-56441f","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-56441f@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc8ec819-9969-4ef4-aff1-5c7d862a34eb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46838","PortSpecifier":{"PortValue":46838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46838","PortSpecifier":{"PortValue":46838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014930,"nanos":760019277},"http":{"id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3\"}"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","subscription":"e2e-rate-iso-a-56441f","tenant":"e2e-shared-a-1381a9","userId":"164a29a7-8348-4801-8055-ed3f1f413523","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-56441f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-56441f"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","selected_subscription":"e2e-rate-iso-a-56441f","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-56441f@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"426a68fe-c1b5-4fd6-b911-a96348e2b8aa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46850","PortSpecifier":{"PortValue":46850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46850","PortSpecifier":{"PortValue":46850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014931,"nanos":806643154},"http":{"id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FuoRc33pVqm3bKZP_dIDMPnbT5Ec5u3pl3AYrCSkBi4bEQGIoFqyGRZQFqc3\"}"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","subscription":"e2e-rate-iso-a-56441f","tenant":"e2e-shared-a-1381a9","userId":"164a29a7-8348-4801-8055-ed3f1f413523","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-56441f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-56441f"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"164a29a7-8348-4801-8055-ed3f1f413523","keyName":"e2e-rate-a-56441f","selected_subscription":"e2e-rate-iso-a-56441f","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-56441f@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-56441f","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f6a0393-7fa6-43f0-a2d0-a29d7513c554","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47366","PortSpecifier":{"PortValue":47366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47366","PortSpecifier":{"PortValue":47366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014944,"nanos":663259724},"http":{"id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d4b8a4-6a0a-49d7-818a-1269b865766f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60208","PortSpecifier":{"PortValue":60208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60208","PortSpecifier":{"PortValue":60208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014944,"nanos":711752068},"http":{"id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"]}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fb7d4aaf259a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9b34fcfb-523f-4144-a165-fc06fd6bc7dc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d4088a18-e5d7-4e2b-afe2-5866b5ab7776","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65da3635-78ea-4c28-af6d-a94ed81a44ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47380","PortSpecifier":{"PortValue":47380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20c3f483-e0d0-4782-9656-b92ad16deca9","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47380","PortSpecifier":{"PortValue":47380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014944,"nanos":753774361},"http":{"id":"20c3f483-e0d0-4782-9656-b92ad16deca9","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL\"}"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","subscription":"e2e-rate-iso-a-e3aac5","tenant":"e2e-shared-a-1381a9","userId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","selected_subscription":"e2e-rate-iso-a-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-e3aac5@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20c3f483-e0d0-4782-9656-b92ad16deca9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47386","PortSpecifier":{"PortValue":47386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47386","PortSpecifier":{"PortValue":47386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014945,"nanos":795373294},"http":{"id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL\"}"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","subscription":"e2e-rate-iso-a-e3aac5","tenant":"e2e-shared-a-1381a9","userId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","selected_subscription":"e2e-rate-iso-a-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-e3aac5@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47390","PortSpecifier":{"PortValue":47390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47390","PortSpecifier":{"PortValue":47390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014946,"nanos":835832766},"http":{"id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","subscription":"e2e-rate-iso-a-e3aac5","tenant":"e2e-shared-a-1381a9","userId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","selected_subscription":"e2e-rate-iso-a-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-e3aac5@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60212","PortSpecifier":{"PortValue":60212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"748f9802-62b5-4626-9628-cda2bf30eb08","method":"POST","path":"/ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18/v1/completions","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60212","PortSpecifier":{"PortValue":60212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014946,"nanos":876641461},"http":{"id":"748f9802-62b5-4626-9628-cda2bf30eb08","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IrbZe1VDYXXxwluF_sGgPett6YPmaIXs05Etv2h6FPS7iTKnEyeihDRHSacM"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IrbZe1VDYXXxwluF_sGgPett6YPmaIXs05Etv2h6FPS7iTKnEyeihDRHSacM\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","keyName":"e2e-rate-b-e3aac5","subscription":"e2e-rate-iso-b-e3aac5","tenant":"e2e-shared-b-d1bf18","userId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\",\"requestedSubscription\":\"e2e-rate-iso-b-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1bf18","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e3aac5","namespace":"ai-tenant-e2e-shared-b-d1bf18","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","keyName":"e2e-rate-b-e3aac5","selected_subscription":"e2e-rate-iso-b-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-b-d1bf18/e2e-rate-iso-b-e3aac5@ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1bf18","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e3aac5","namespace":"ai-tenant-e2e-shared-b-d1bf18","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52294","PortSpecifier":{"PortValue":52294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52294","PortSpecifier":{"PortValue":52294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":339267703},"http":{"id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015010,"groups":["Engineering","Project-Alpha"],"iat":1783014950,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a0b30f63-2027-de4b-7f0e-991cd6c6f65f","preferred_username":"alice_lead","scope":"profile email","sid":"GoY8zvKszA3-r0Hq14l1PL0l","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015010,"groups":["Engineering","Project-Alpha"],"iat":1783014950,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a0b30f63-2027-de4b-7f0e-991cd6c6f65f","preferred_username":"alice_lead","scope":"profile email","sid":"GoY8zvKszA3-r0Hq14l1PL0l","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52302","PortSpecifier":{"PortValue":52302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6413b367-a11c-469d-ac59-7d23dba4e148","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52302","PortSpecifier":{"PortValue":52302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":530283517},"http":{"id":"6413b367-a11c-469d-ac59-7d23dba4e148","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52308","PortSpecifier":{"PortValue":52308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52308","PortSpecifier":{"PortValue":52308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":592875892},"http":{"id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.15","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.15","x-forwarded-host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0"},"path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52318","PortSpecifier":{"PortValue":52318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52318","PortSpecifier":{"PortValue":52318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":626227565},"http":{"id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.15","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.15","x-forwarded-host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"677bffee-0ffa-4300-89d0-f83dd3f984b3"},"path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36866","PortSpecifier":{"PortValue":36866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36866","PortSpecifier":{"PortValue":36866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":777244402},"http":{"id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 16:55:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"info","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53072","PortSpecifier":{"PortValue":53072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53072","PortSpecifier":{"PortValue":53072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015015,"nanos":955337941},"http":{"id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 17:56:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53078","PortSpecifier":{"PortValue":53078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b025a94-a02e-9fbc-8e50-a26263117a61","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53078","PortSpecifier":{"PortValue":53078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015016,"nanos":647446114},"http":{"id":"3b025a94-a02e-9fbc-8e50-a26263117a61","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015076,"groups":["Site-Reliability"],"iat":1783015016,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:68531ba3-1f51-0e86-af6c-5bf2f601988e","preferred_username":"bob_sre","scope":"profile email","sid":"I0hlAwkym_eUxc21xDBt2xFF","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015076,"groups":["Site-Reliability"],"iat":1783015016,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:68531ba3-1f51-0e86-af6c-5bf2f601988e","preferred_username":"bob_sre","scope":"profile email","sid":"I0hlAwkym_eUxc21xDBt2xFF","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53094","PortSpecifier":{"PortValue":53094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53094","PortSpecifier":{"PortValue":53094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":51529196},"http":{"id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:24be6938-4b54-5073-7b48-9a36f513092c","preferred_username":"alice_lead","scope":"profile email","sid":"Eq9ABOE9Wpq2dMsbZDjtf9SN","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:24be6938-4b54-5073-7b48-9a36f513092c","preferred_username":"alice_lead","scope":"profile email","sid":"Eq9ABOE9Wpq2dMsbZDjtf9SN","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fa81ee5-0c62-4f22-a014-8969df90399d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":86500866},"http":{"id":"0fa81ee5-0c62-4f22-a014-8969df90399d","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":114488400},"http":{"id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":114488400,"seconds":1783015017},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":155534591},"http":{"id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53126","PortSpecifier":{"PortValue":53126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53126","PortSpecifier":{"PortValue":53126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":323516869},"http":{"id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53142","PortSpecifier":{"PortValue":53142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"daef8c7f-afc3-488b-959f-8bac14480d89","method":"DELETE","path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53142","PortSpecifier":{"PortValue":53142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":357423170},"http":{"id":"daef8c7f-afc3-488b-959f-8bac14480d89","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":388331620},"http":{"id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53158","PortSpecifier":{"PortValue":53158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53158","PortSpecifier":{"PortValue":53158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":416800692},"http":{"id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53174","PortSpecifier":{"PortValue":53174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"954b52cb-1dca-4623-b7af-4e9662093a17","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53174","PortSpecifier":{"PortValue":53174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":624538452},"http":{"id":"954b52cb-1dca-4623-b7af-4e9662093a17","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53180","PortSpecifier":{"PortValue":53180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53180","PortSpecifier":{"PortValue":53180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":918218933},"http":{"id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3dfc28b4-7e91-40bb-6209-a83a32b3c5b8","preferred_username":"alice_lead","scope":"profile email","sid":"fPgszwsbbXD7PvWFBO2QRbf4","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3dfc28b4-7e91-40bb-6209-a83a32b3c5b8","preferred_username":"alice_lead","scope":"profile email","sid":"fPgszwsbbXD7PvWFBO2QRbf4","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68733b57-deee-43eb-aa22-8519b2d73011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53184","PortSpecifier":{"PortValue":53184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68733b57-deee-43eb-aa22-8519b2d73011","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68733b57-deee-43eb-aa22-8519b2d73011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53184","PortSpecifier":{"PortValue":53184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":971613930},"http":{"id":"68733b57-deee-43eb-aa22-8519b2d73011","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Site-Reliability"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:de704d2d-126b-f349-553d-57aba3023c04","preferred_username":"bob_sre","scope":"profile email","sid":"7OVXw9HQ_HdXp5YHxPNdmUjz","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68733b57-deee-43eb-aa22-8519b2d73011","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Site-Reliability"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:de704d2d-126b-f349-553d-57aba3023c04","preferred_username":"bob_sre","scope":"profile email","sid":"7OVXw9HQ_HdXp5YHxPNdmUjz","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53188","PortSpecifier":{"PortValue":53188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53188","PortSpecifier":{"PortValue":53188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":131052332},"http":{"id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53192","PortSpecifier":{"PortValue":53192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","method":"DELETE","path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53192","PortSpecifier":{"PortValue":53192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":160613103},"http":{"id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53208","PortSpecifier":{"PortValue":53208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","method":"DELETE","path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53208","PortSpecifier":{"PortValue":53208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":194011610},"http":{"id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53224","PortSpecifier":{"PortValue":53224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53224","PortSpecifier":{"PortValue":53224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":352789835},"http":{"id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:b40a3a05-61e3-3cd1-24a1-8c1804f802a2","preferred_username":"alice_lead","scope":"profile email","sid":"Z0k8B9dtDtagMkiUPTsRHDKp","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:b40a3a05-61e3-3cd1-24a1-8c1804f802a2","preferred_username":"alice_lead","scope":"profile email","sid":"Z0k8B9dtDtagMkiUPTsRHDKp","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53226","PortSpecifier":{"PortValue":53226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53226","PortSpecifier":{"PortValue":53226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":384323261},"http":{"id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":391908682},"http":{"id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9a61695c-afc1-484a-b1e7-92aacea10ed1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":391908682,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53240","PortSpecifier":{"PortValue":53240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53240","PortSpecifier":{"PortValue":53240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":554381496},"http":{"id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3198382e-37c3-bf2b-c9e4-69c5c0df8a47","preferred_username":"alice_lead","scope":"profile email","sid":"JE0b4llX5-eCISHSLqorw_tS","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3198382e-37c3-bf2b-c9e4-69c5c0df8a47","preferred_username":"alice_lead","scope":"profile email","sid":"JE0b4llX5-eCISHSLqorw_tS","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53242","PortSpecifier":{"PortValue":53242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53242","PortSpecifier":{"PortValue":53242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":585098037},"http":{"id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53246","PortSpecifier":{"PortValue":53246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adaccd4e-6adc-40f1-9a21-800603e4944b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53246","PortSpecifier":{"PortValue":53246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":616797560},"http":{"id":"adaccd4e-6adc-40f1-9a21-800603e4944b","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":623987296},"http":{"id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"984a604c-6474-475a-99c1-ecdb10d1e314"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":623987296,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53258","PortSpecifier":{"PortValue":53258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"316188b4-b3a6-495c-946d-22858b8fc85a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53258","PortSpecifier":{"PortValue":53258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":779129731},"http":{"id":"316188b4-b3a6-495c-946d-22858b8fc85a","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:28de6046-72ef-6dd2-5edc-caa82ad58893","preferred_username":"alice_lead","scope":"profile email","sid":"qAqXcbIlCz8dhyJoYAMyWlMI","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:28de6046-72ef-6dd2-5edc-caa82ad58893","preferred_username":"alice_lead","scope":"profile email","sid":"qAqXcbIlCz8dhyJoYAMyWlMI","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89cf9764-5e13-42f4-a0c9-78488ccba811","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":808272607},"http":{"id":"89cf9764-5e13-42f4-a0c9-78488ccba811","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":815779234},"http":{"id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":815779234,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53262","PortSpecifier":{"PortValue":53262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53262","PortSpecifier":{"PortValue":53262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":847304398},"http":{"id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":854640703},"http":{"id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"69be1fec-7c9d-444d-9eff-92da801150cf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":854640703,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53272","PortSpecifier":{"PortValue":53272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53272","PortSpecifier":{"PortValue":53272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015019,"nanos":10670440},"http":{"id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:668328de-f27f-3a02-5a5a-cb98eefd89ee","preferred_username":"alice_lead","scope":"profile email","sid":"7xSolgsQnKlVVvqYQd5gIvIb","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:668328de-f27f-3a02-5a5a-cb98eefd89ee","preferred_username":"alice_lead","scope":"profile email","sid":"7xSolgsQnKlVVvqYQd5gIvIb","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:57:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"info","ts":"2026-07-02T17:57:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"}