{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","selected_subscription":"e2e-rate-iso-a-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-e3aac5@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"758a83cf-d522-49f6-bee5-bcd70b23d8cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47390","PortSpecifier":{"PortValue":47390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","method":"POST","path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions","host":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47390","PortSpecifier":{"PortValue":47390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014946,"nanos":835832766},"http":{"id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","method":"POST","headers":{":authority":"e2e-shared-a-1381a9.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16fKnnww36A4xM6hB_JWqYpPHVtAlxW9Vogs29lfA5kMp1UpA8TV5Wcd3ZPDL\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","subscription":"e2e-rate-iso-a-e3aac5","tenant":"e2e-shared-a-1381a9","userId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\",\"requestedSubscription\":\"e2e-rate-iso-a-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1381a9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3821273d-4d00-44c1-b8c6-8d1fb9b8cf4a","keyName":"e2e-rate-a-e3aac5","selected_subscription":"e2e-rate-iso-a-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-a-1381a9/e2e-rate-iso-a-e3aac5@ai-tenant-e2e-shared-a-1381a9/rate-test-model-1381a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1381a9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3aac5","namespace":"ai-tenant-e2e-shared-a-1381a9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c03a0a1a-543b-4c6d-b7a8-a06216e03f64","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60212","PortSpecifier":{"PortValue":60212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"748f9802-62b5-4626-9628-cda2bf30eb08","method":"POST","path":"/ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18/v1/completions","host":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60212","PortSpecifier":{"PortValue":60212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014946,"nanos":876641461},"http":{"id":"748f9802-62b5-4626-9628-cda2bf30eb08","method":"POST","headers":{":authority":"e2e-shared-b-d1bf18.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IrbZe1VDYXXxwluF_sGgPett6YPmaIXs05Etv2h6FPS7iTKnEyeihDRHSacM"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IrbZe1VDYXXxwluF_sGgPett6YPmaIXs05Etv2h6FPS7iTKnEyeihDRHSacM\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","keyName":"e2e-rate-b-e3aac5","subscription":"e2e-rate-iso-b-e3aac5","tenant":"e2e-shared-b-d1bf18","userId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\",\"requestedSubscription\":\"e2e-rate-iso-b-e3aac5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d1bf18.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1bf18","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e3aac5","namespace":"ai-tenant-e2e-shared-b-d1bf18","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e3aac5"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bd2225ff-0a22-4c7e-9343-570b14c7370a","keyName":"e2e-rate-b-e3aac5","selected_subscription":"e2e-rate-iso-b-e3aac5","selected_subscription_key":"ai-tenant-e2e-shared-b-d1bf18/e2e-rate-iso-b-e3aac5@ai-tenant-e2e-shared-b-d1bf18/rate-test-model-d1bf18","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1bf18","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e3aac5","namespace":"ai-tenant-e2e-shared-b-d1bf18","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"748f9802-62b5-4626-9628-cda2bf30eb08","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52294","PortSpecifier":{"PortValue":52294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52294","PortSpecifier":{"PortValue":52294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":339267703},"http":{"id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015010,"groups":["Engineering","Project-Alpha"],"iat":1783014950,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a0b30f63-2027-de4b-7f0e-991cd6c6f65f","preferred_username":"alice_lead","scope":"profile email","sid":"GoY8zvKszA3-r0Hq14l1PL0l","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015010,"groups":["Engineering","Project-Alpha"],"iat":1783014950,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a0b30f63-2027-de4b-7f0e-991cd6c6f65f","preferred_username":"alice_lead","scope":"profile email","sid":"GoY8zvKszA3-r0Hq14l1PL0l","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc300f89-b7c9-4fba-bdc2-8a1759bdb155","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52302","PortSpecifier":{"PortValue":52302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6413b367-a11c-469d-ac59-7d23dba4e148","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52302","PortSpecifier":{"PortValue":52302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":530283517},"http":{"id":"6413b367-a11c-469d-ac59-7d23dba4e148","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6413b367-a11c-469d-ac59-7d23dba4e148","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52308","PortSpecifier":{"PortValue":52308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52308","PortSpecifier":{"PortValue":52308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":592875892},"http":{"id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.15","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.15","x-forwarded-host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0"},"path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f0f88e1-f1c5-4bd1-a42b-6fa4489647e0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52318","PortSpecifier":{"PortValue":52318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52318","PortSpecifier":{"PortValue":52318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":626227565},"http":{"id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.15","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.15","x-forwarded-host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"677bffee-0ffa-4300-89d0-f83dd3f984b3"},"path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"677bffee-0ffa-4300-89d0-f83dd3f984b3","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36866","PortSpecifier":{"PortValue":36866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36866","PortSpecifier":{"PortValue":36866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014950,"nanos":777244402},"http":{"id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 16:55:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d8e388d-8171-4a75-9f54-a5b76ce4bcb0","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05cd03a1a8d204c791f0d3e5f111dbd9fe1000c33067a0c4ed8ba60ae7c64436"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44d0be35f69533721ff2dd26bbb7b50ba63fbd9ecaa229b6649ae73f4a113c75"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf2bf5eebf8f2672e070ff1a0d3d429ee7bb826922f6ea74d29941fdc0df3725"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cfc837bec3d5b7f38817df7dde98893ff2bef10d67cf0c334983008081d7ada"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f201102bc2b1079abe32fc7e622f00f3b208b227cb03d9a3f1bf0f8b510adb4"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fdad7069a9f6fcf2e207b628c6d50ae345d153aa609ce38c9c3832c768efca2"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fe31390e825833eb00efc172037978c047d889906bbe5a5376bf8905e433699"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce07adc776c422d910a7f3e472923e7c516f84409a0e9bbd70b89e994d100245"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ee1914388ed6f690bb16f797cbc098c2750e618671357e0bca3e4d0446705d6"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/012998f200cd1fd837f413542d30369b6d6db2a763d7c33df488c75f1d0b3ff2"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c70ef5270903e43feeaa5bc0b9977c04ad9b50255743cc79582c7c02a77595b"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8ca03639f478267df73ce3c2292944313ad73e38b6347033d8964c3f6351aed"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76934d6147ccfe18ab2144943051e4d43a5ff48edc875450b41e0ede2816b7cc"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/687c4de25e26cc2464ba1a4975638d6b46066b5dbdce15079ea29ce75b80be3d"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd64ae07ffcfe82c7bd82e1c2449fe5661d393298659c4f10e94c6d64e2ac8c1"}
{"level":"info","ts":"2026-07-02T17:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d1a0a35b3c0c4cb26f119e602db589538f2de09098bad1530ecefc3670efe1b7"}
{"level":"info","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53072","PortSpecifier":{"PortValue":53072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53072","PortSpecifier":{"PortValue":53072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015015,"nanos":955337941},"http":{"id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 17:56:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:56:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b5f5f0-b6d6-462d-94a0-fcd6de14b3e4","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53078","PortSpecifier":{"PortValue":53078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b025a94-a02e-9fbc-8e50-a26263117a61","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53078","PortSpecifier":{"PortValue":53078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015016,"nanos":647446114},"http":{"id":"3b025a94-a02e-9fbc-8e50-a26263117a61","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015076,"groups":["Site-Reliability"],"iat":1783015016,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:68531ba3-1f51-0e86-af6c-5bf2f601988e","preferred_username":"bob_sre","scope":"profile email","sid":"I0hlAwkym_eUxc21xDBt2xFF","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015076,"groups":["Site-Reliability"],"iat":1783015016,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:68531ba3-1f51-0e86-af6c-5bf2f601988e","preferred_username":"bob_sre","scope":"profile email","sid":"I0hlAwkym_eUxc21xDBt2xFF","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b025a94-a02e-9fbc-8e50-a26263117a61","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53094","PortSpecifier":{"PortValue":53094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53094","PortSpecifier":{"PortValue":53094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":51529196},"http":{"id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:24be6938-4b54-5073-7b48-9a36f513092c","preferred_username":"alice_lead","scope":"profile email","sid":"Eq9ABOE9Wpq2dMsbZDjtf9SN","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:24be6938-4b54-5073-7b48-9a36f513092c","preferred_username":"alice_lead","scope":"profile email","sid":"Eq9ABOE9Wpq2dMsbZDjtf9SN","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a15685a5-9b0d-4c1f-9bd8-64189cfb36ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fa81ee5-0c62-4f22-a014-8969df90399d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":86500866},"http":{"id":"0fa81ee5-0c62-4f22-a014-8969df90399d","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa81ee5-0c62-4f22-a014-8969df90399d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":114488400},"http":{"id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":114488400,"seconds":1783015017},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e58f24-3e92-45d9-b5f3-e9c4035294d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":155534591},"http":{"id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1VzI4S0EU5Ugp1WB4_1nVWZRwEh8lL04OtDlfP7JCtYxpXV4dzYEmLVHwDtIL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"60633834-b9a5-4ed1-b3d7-09089d866aa6","keyName":"e2e-oidc-d02a73b2","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05410cca-fc9d-4a4e-b3f7-e0a0589ed766","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53126","PortSpecifier":{"PortValue":53126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53126","PortSpecifier":{"PortValue":53126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":323516869},"http":{"id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d289cf8f-e64c-418f-afce-c02947ba8e1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53142","PortSpecifier":{"PortValue":53142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"daef8c7f-afc3-488b-959f-8bac14480d89","method":"DELETE","path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53142","PortSpecifier":{"PortValue":53142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":357423170},"http":{"id":"daef8c7f-afc3-488b-959f-8bac14480d89","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1198cc51-d13a-3aec-a2a7-b3805d6b98b5","preferred_username":"alice_lead","scope":"profile email","sid":"uSPycP4IBIK984xMlNyBX4xn","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/7005b2f4-5dae-482a-8ff4-2811857c1cc0",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daef8c7f-afc3-488b-959f-8bac14480d89","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":388331620},"http":{"id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de87cd43-f1c3-40c6-8a94-af94eb22049e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53158","PortSpecifier":{"PortValue":53158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53158","PortSpecifier":{"PortValue":53158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":416800692},"http":{"id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dJFmOKlDiLsqgEc2_KFYjX84vKpBU2CoDnJ4so9C9Qrt1JP36pfMWRk6neo\"}"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd16fe5-63f6-49bb-be99-9b940513bc9a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53174","PortSpecifier":{"PortValue":53174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"954b52cb-1dca-4623-b7af-4e9662093a17","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53174","PortSpecifier":{"PortValue":53174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":624538452},"http":{"id":"954b52cb-1dca-4623-b7af-4e9662093a17","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"954b52cb-1dca-4623-b7af-4e9662093a17","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53180","PortSpecifier":{"PortValue":53180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53180","PortSpecifier":{"PortValue":53180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":918218933},"http":{"id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3dfc28b4-7e91-40bb-6209-a83a32b3c5b8","preferred_username":"alice_lead","scope":"profile email","sid":"fPgszwsbbXD7PvWFBO2QRbf4","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Engineering","Project-Alpha"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3dfc28b4-7e91-40bb-6209-a83a32b3c5b8","preferred_username":"alice_lead","scope":"profile email","sid":"fPgszwsbbXD7PvWFBO2QRbf4","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446b7ea0-ded0-45be-bbbc-41a9b5a4b590","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68733b57-deee-43eb-aa22-8519b2d73011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53184","PortSpecifier":{"PortValue":53184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68733b57-deee-43eb-aa22-8519b2d73011","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68733b57-deee-43eb-aa22-8519b2d73011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53184","PortSpecifier":{"PortValue":53184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015017,"nanos":971613930},"http":{"id":"68733b57-deee-43eb-aa22-8519b2d73011","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Site-Reliability"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:de704d2d-126b-f349-553d-57aba3023c04","preferred_username":"bob_sre","scope":"profile email","sid":"7OVXw9HQ_HdXp5YHxPNdmUjz","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68733b57-deee-43eb-aa22-8519b2d73011","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015077,"groups":["Site-Reliability"],"iat":1783015017,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:de704d2d-126b-f349-553d-57aba3023c04","preferred_username":"bob_sre","scope":"profile email","sid":"7OVXw9HQ_HdXp5YHxPNdmUjz","sub":"6e473dfb-18be-44da-8c4c-c8e8aa3bd2ea","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68733b57-deee-43eb-aa22-8519b2d73011","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68733b57-deee-43eb-aa22-8519b2d73011","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53188","PortSpecifier":{"PortValue":53188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53188","PortSpecifier":{"PortValue":53188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":131052332},"http":{"id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63af4602-ee25-43d5-b3fc-5d3fd2d240f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53192","PortSpecifier":{"PortValue":53192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","method":"DELETE","path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53192","PortSpecifier":{"PortValue":53192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":160613103},"http":{"id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16154ec3-d9bd-4384-b49b-45b9f6b22806","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53208","PortSpecifier":{"PortValue":53208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","method":"DELETE","path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53208","PortSpecifier":{"PortValue":53208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":194011610},"http":{"id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","method":"DELETE","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c9467a17-e6e7-13ba-56c9-eda18b060e95","preferred_username":"alice_lead","scope":"profile email","sid":"5mN9W1ptBE81jQpvRqgOhWkq","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/14d56148-70a7-462b-b076-7e4cb4ecbded",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44a89d00-9149-4007-9eb6-0f56d16f0e6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53224","PortSpecifier":{"PortValue":53224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53224","PortSpecifier":{"PortValue":53224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":352789835},"http":{"id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:b40a3a05-61e3-3cd1-24a1-8c1804f802a2","preferred_username":"alice_lead","scope":"profile email","sid":"Z0k8B9dtDtagMkiUPTsRHDKp","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:b40a3a05-61e3-3cd1-24a1-8c1804f802a2","preferred_username":"alice_lead","scope":"profile email","sid":"Z0k8B9dtDtagMkiUPTsRHDKp","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05d117df-92d8-4c7f-a43d-f3beffce81d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53226","PortSpecifier":{"PortValue":53226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53226","PortSpecifier":{"PortValue":53226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":384323261},"http":{"id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c37e50d-a940-476f-b2da-5f19e96e5ccd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":391908682},"http":{"id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-rigCOrYUNNsT8vgU_rRoenWQO48MkIN5s5rzP0K0XI3NOszJZrBOhLwLXMud","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9a61695c-afc1-484a-b1e7-92aacea10ed1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":391908682,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9e73ac28-27b8-4f24-a002-7cbdd289be3a","keyName":"e2e-oidc-709ed8f4","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a61695c-afc1-484a-b1e7-92aacea10ed1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53240","PortSpecifier":{"PortValue":53240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53240","PortSpecifier":{"PortValue":53240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":554381496},"http":{"id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3198382e-37c3-bf2b-c9e4-69c5c0df8a47","preferred_username":"alice_lead","scope":"profile email","sid":"JE0b4llX5-eCISHSLqorw_tS","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3198382e-37c3-bf2b-c9e4-69c5c0df8a47","preferred_username":"alice_lead","scope":"profile email","sid":"JE0b4llX5-eCISHSLqorw_tS","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fea310bd-fecb-45d6-8fa5-ecc9fb762d72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53242","PortSpecifier":{"PortValue":53242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53242","PortSpecifier":{"PortValue":53242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":585098037},"http":{"id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb65ea8-b569-4b50-8df5-fa62ccae9a13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53246","PortSpecifier":{"PortValue":53246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adaccd4e-6adc-40f1-9a21-800603e4944b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53246","PortSpecifier":{"PortValue":53246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":616797560},"http":{"id":"adaccd4e-6adc-40f1-9a21-800603e4944b","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adaccd4e-6adc-40f1-9a21-800603e4944b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":623987296},"http":{"id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-14tiZbWy3bw5oqBnV_9x1IggVbJFdTKjsZ4IauuqMNaSbfd72vl62sNtDpWyL","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"984a604c-6474-475a-99c1-ecdb10d1e314"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"984a604c-6474-475a-99c1-ecdb10d1e314","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":623987296,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"1cda3bc5-2f42-4e4c-9af3-0b13632b3897","keyName":"e2e-oidc-2b56a35f","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984a604c-6474-475a-99c1-ecdb10d1e314","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53258","PortSpecifier":{"PortValue":53258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"316188b4-b3a6-495c-946d-22858b8fc85a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53258","PortSpecifier":{"PortValue":53258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":779129731},"http":{"id":"316188b4-b3a6-495c-946d-22858b8fc85a","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:28de6046-72ef-6dd2-5edc-caa82ad58893","preferred_username":"alice_lead","scope":"profile email","sid":"qAqXcbIlCz8dhyJoYAMyWlMI","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:28de6046-72ef-6dd2-5edc-caa82ad58893","preferred_username":"alice_lead","scope":"profile email","sid":"qAqXcbIlCz8dhyJoYAMyWlMI","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"316188b4-b3a6-495c-946d-22858b8fc85a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89cf9764-5e13-42f4-a0c9-78488ccba811","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":808272607},"http":{"id":"89cf9764-5e13-42f4-a0c9-78488ccba811","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89cf9764-5e13-42f4-a0c9-78488ccba811","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":815779234},"http":{"id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":815779234,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b63520-53d0-4ff9-8fc5-97cabe61e6cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53262","PortSpecifier":{"PortValue":53262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53262","PortSpecifier":{"PortValue":53262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":847304398},"http":{"id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","method":"GET","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae2d5669-b521-418d-a393-6a1bc1bcc0fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.24:46570","PortSpecifier":{"PortValue":46570}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015018,"nanos":854640703},"http":{"id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d1b3e67e-990e-489f-83f8-c9197d7be524","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-JCh3t7rhqXjRplbj_w72L12YePg8gm2VgOyCwGrzdl2zNOTsG5tz7GuNboZN","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.24","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcG1odDYKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.21~maas-default-gateway-openshift-default-56654dcf7-pmht6.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.24","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"69be1fec-7c9d-444d-9eff-92da801150cf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"69be1fec-7c9d-444d-9eff-92da801150cf","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":854640703,"seconds":1783015018},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.24:46570","port":46570}}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"d1b3e67e-990e-489f-83f8-c9197d7be524","keyName":"e2e-oidc-283d9656","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69be1fec-7c9d-444d-9eff-92da801150cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53272","PortSpecifier":{"PortValue":53272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53272","PortSpecifier":{"PortValue":53272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.21:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783015019,"nanos":10670440},"http":{"id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","method":"POST","headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:668328de-f27f-3a02-5a5a-cb98eefd89ee","preferred_username":"alice_lead","scope":"profile email","sid":"7xSolgsQnKlVVvqYQd5gIvIb","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783015078,"groups":["Engineering","Project-Alpha"],"iat":1783015018,"iss":"https://keycloak.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:668328de-f27f-3a02-5a5a-cb98eefd89ee","preferred_username":"alice_lead","scope":"profile email","sid":"7xSolgsQnKlVVvqYQd5gIvIb","sub":"7febe881-1450-406d-b0e5-8f49ae442fda","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.21:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.48c0fbd3-54e3-4fe4-9bd2-fb7d4aaf259a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04fb847f-988c-49cf-b6c8-29fa60521dd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:57:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0cc78b04b381b97d9b4d9811540f2985c7d0e2b506d2083a2617cd2ea24c68f4"}
{"level":"info","ts":"2026-07-02T17:57:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8314e61eb0076803970f44c6d16eb58a61739f50662d50abb626976c82ddfff2"}
{"level":"info","ts":"2026-07-02T17:57:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f007360f3c0c0ee69213c587b6aea805b3dbd26b26e2d8c711bcd30c995744c3"}
{"level":"info","ts":"2026-07-02T17:57:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31fa49252a997fd5e9c96dcfdea9c8f2c9ca51377e6f28d8d5900162c539679a"}