{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f33843b41e38e58867c36aea92615a708e74dfacd996984a7f604bade8027ed7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff92c80c78bd406fa290dfaff18ed05eebf42ae05e6d200bfb874e1ab55cbed1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94acd85db1b48e1086c1847f89ddb73222c803a77949bad017fd437ded189b73","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a99775b8d65552d76b9f7dc797653a76972563156274ec42ccfc9332d9735960","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"560d265e0a0820f5afaa21c4a07197f965cd7d5ab4b625bd29ac16bb51232b91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bdbd1d1ed05f54c8d13a6a1a082fde2e9434e9024239cf4b903daf17a41807","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"812245f5ef31040699db3cbfd5101fc1a25ebd8d0fd71e844a181bf05dee699d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9b0bbf3e335bd5c8dcbf05298140cafb2cc964c2ccd34cdb265455d461fe0e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:15:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9b0bbf3e335bd5c8dcbf05298140cafb2cc964c2ccd34cdb265455d461fe0e4"}
{"level":"info","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45712","PortSpecifier":{"PortValue":45712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45712","PortSpecifier":{"PortValue":45712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183324,"nanos":882514759},"http":{"id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"544b33bc1d9fd630e8b81166cfed515a4abc42096844ef034bd6e542105ea971"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d1bab2a-2ae7-45fc-9cb6-ecf62fd4a103","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903d2b4a-74de-4c2f-821c-ead439302068","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:36536","PortSpecifier":{"PortValue":36536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"903d2b4a-74de-4c2f-821c-ead439302068","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903d2b4a-74de-4c2f-821c-ead439302068","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:36536","PortSpecifier":{"PortValue":36536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183324,"nanos":918670654},"http":{"id":"903d2b4a-74de-4c2f-821c-ead439302068","method":"POST","headers":{":authority":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"903d2b4a-74de-4c2f-821c-ead439302068","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"903d2b4a-74de-4c2f-821c-ead439302068","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b6cdc6dbd00a199d8accf61023daeae19e950fc74887c812c9f1b4f7f3af2fdd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-73ce16/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903d2b4a-74de-4c2f-821c-ead439302068","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903d2b4a-74de-4c2f-821c-ead439302068","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903d2b4a-74de-4c2f-821c-ead439302068","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45728","PortSpecifier":{"PortValue":45728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69712e4f-a716-4f4a-a4dc-12a918294897","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45728","PortSpecifier":{"PortValue":45728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183324,"nanos":969666032},"http":{"id":"69712e4f-a716-4f4a-a4dc-12a918294897","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS\"}"}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","subscription":"e2e-rate-iso-a-dad78b","tenant":"e2e-shared-a-d3c546","userId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-dad78b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dad78b"}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","selected_subscription":"e2e-rate-iso-a-dad78b","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-dad78b@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69712e4f-a716-4f4a-a4dc-12a918294897","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45740","PortSpecifier":{"PortValue":45740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ac607de7-0b45-4ea5-89fe-98c87450524a","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45740","PortSpecifier":{"PortValue":45740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183326,"nanos":55365602},"http":{"id":"ac607de7-0b45-4ea5-89fe-98c87450524a","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS\"}"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","subscription":"e2e-rate-iso-a-dad78b","tenant":"e2e-shared-a-d3c546","userId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-dad78b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dad78b"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","selected_subscription":"e2e-rate-iso-a-dad78b","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-dad78b@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac607de7-0b45-4ea5-89fe-98c87450524a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24df557a-0286-4208-af77-b5ce82b62937","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45750","PortSpecifier":{"PortValue":45750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24df557a-0286-4208-af77-b5ce82b62937","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24df557a-0286-4208-af77-b5ce82b62937","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:45750","PortSpecifier":{"PortValue":45750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183327,"nanos":102210327},"http":{"id":"24df557a-0286-4208-af77-b5ce82b62937","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-33o3eZRwNoJZMwrs_MntbqdCB6ByIVC8O8bzp2ptRGbitsNIk2Ddh7gCjYjS\"}"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","subscription":"e2e-rate-iso-a-dad78b","tenant":"e2e-shared-a-d3c546","userId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-dad78b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24df557a-0286-4208-af77-b5ce82b62937","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dad78b"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24df557a-0286-4208-af77-b5ce82b62937","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b53c1e93-b3d2-4cd5-a2bd-82c67771de21","keyName":"e2e-rate-a-dad78b","selected_subscription":"e2e-rate-iso-a-dad78b","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-dad78b@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dad78b","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24df557a-0286-4208-af77-b5ce82b62937","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24df557a-0286-4208-af77-b5ce82b62937","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47700","PortSpecifier":{"PortValue":47700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47700","PortSpecifier":{"PortValue":47700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183353,"nanos":422198428},"http":{"id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"544b33bc1d9fd630e8b81166cfed515a4abc42096844ef034bd6e542105ea971"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43ce13c5-4a4d-4a02-8c61-3e18d5a2ab90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43372","PortSpecifier":{"PortValue":43372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43372","PortSpecifier":{"PortValue":43372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183353,"nanos":456813316},"http":{"id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","method":"POST","headers":{":authority":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b6cdc6dbd00a199d8accf61023daeae19e950fc74887c812c9f1b4f7f3af2fdd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-73ce16/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8b7c0bf-fe70-4f8e-90e0-6f3566272cce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47714","PortSpecifier":{"PortValue":47714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47714","PortSpecifier":{"PortValue":47714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183353,"nanos":487099899},"http":{"id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi\"}"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","subscription":"e2e-rate-iso-a-07317e","tenant":"e2e-shared-a-d3c546","userId":"01173d94-2f82-49aa-9d31-8db7d497e5db","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-07317e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-07317e"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","selected_subscription":"e2e-rate-iso-a-07317e","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-07317e@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dee7ac3f-944c-4e57-b510-8df0864b93b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47722","PortSpecifier":{"PortValue":47722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fe94927-4069-47e7-8819-d7cd463e1120","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47722","PortSpecifier":{"PortValue":47722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183354,"nanos":532405396},"http":{"id":"1fe94927-4069-47e7-8819-d7cd463e1120","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi\"}"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","subscription":"e2e-rate-iso-a-07317e","tenant":"e2e-shared-a-d3c546","userId":"01173d94-2f82-49aa-9d31-8db7d497e5db","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-07317e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-07317e"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","selected_subscription":"e2e-rate-iso-a-07317e","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-07317e@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fe94927-4069-47e7-8819-d7cd463e1120","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47738","PortSpecifier":{"PortValue":47738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","method":"POST","path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions","host":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:47738","PortSpecifier":{"PortValue":47738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183355,"nanos":573842791},"http":{"id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","method":"POST","headers":{":authority":"e2e-shared-a-d3c546.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-auaDvFgBjH9tgEgm_c6fEHlsJf3PS7yfTDkV8yz9hloFE0lTs6lqzkxmYvDi\"}"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","subscription":"e2e-rate-iso-a-07317e","tenant":"e2e-shared-a-d3c546","userId":"01173d94-2f82-49aa-9d31-8db7d497e5db","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\",\"requestedSubscription\":\"e2e-rate-iso-a-07317e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d3c546.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-07317e"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"01173d94-2f82-49aa-9d31-8db7d497e5db","keyName":"e2e-rate-a-07317e","selected_subscription":"e2e-rate-iso-a-07317e","selected_subscription_key":"ai-tenant-e2e-shared-a-d3c546/e2e-rate-iso-a-07317e@ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d3c546/models/facebook/opt-125m","name":"rate-test-model-d3c546","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-07317e","namespace":"ai-tenant-e2e-shared-a-d3c546","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d3c546/rate-test-model-d3c546"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a564bc0-0a26-4185-b7fb-4a5a587678ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43386","PortSpecifier":{"PortValue":43386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5defff2f-33bd-4876-85fc-69b59f8f4930","method":"POST","path":"/ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16/v1/completions","host":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43386","PortSpecifier":{"PortValue":43386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183355,"nanos":607926914},"http":{"id":"5defff2f-33bd-4876-85fc-69b59f8f4930","method":"POST","headers":{":authority":"e2e-shared-b-73ce16.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Ju9LXoqe9EpltH8B_qgv2wm6MIOfdJEM58XUqqnjiTlaeb1N5KBGxeGi74sI"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-73ce16.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Ju9LXoqe9EpltH8B_qgv2wm6MIOfdJEM58XUqqnjiTlaeb1N5KBGxeGi74sI\"}"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-73ce16.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13bf9678-36cd-4276-964a-97669ae5cfce","keyName":"e2e-rate-b-07317e","subscription":"e2e-rate-iso-b-07317e","tenant":"e2e-shared-b-73ce16","userId":"13bf9678-36cd-4276-964a-97669ae5cfce","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-73ce16.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16\",\"requestedSubscription\":\"e2e-rate-iso-b-07317e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-73ce16.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-73ce16/models/facebook/opt-125m","name":"rate-test-model-73ce16","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-07317e","namespace":"ai-tenant-e2e-shared-b-73ce16","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16"}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-73ce16/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-07317e"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13bf9678-36cd-4276-964a-97669ae5cfce","keyName":"e2e-rate-b-07317e","selected_subscription":"e2e-rate-iso-b-07317e","selected_subscription_key":"ai-tenant-e2e-shared-b-73ce16/e2e-rate-iso-b-07317e@ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-73ce16/models/facebook/opt-125m","name":"rate-test-model-73ce16","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-07317e","namespace":"ai-tenant-e2e-shared-b-73ce16","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-73ce16/rate-test-model-73ce16"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:15:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5defff2f-33bd-4876-85fc-69b59f8f4930","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:16:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9ce7de8e6addd30277793d860045fef0dbe13ec01cdad5b50633191b410d89f"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cdd3aaed17de1f657d3040c807dd2efefbb640e58592a5b19e60f99b497c92a0"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff92c80c78bd406fa290dfaff18ed05eebf42ae05e6d200bfb874e1ab55cbed1"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf484170451dedb99b932f11faa1b8c09b6c907e8b4102359a05c444a3a0fc67"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60bdbd1d1ed05f54c8d13a6a1a082fde2e9434e9024239cf4b903daf17a41807"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/560d265e0a0820f5afaa21c4a07197f965cd7d5ab4b625bd29ac16bb51232b91"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3edd14fbb808f7b7927806e5609f67cce67de082f410351ea88033aaf82be347"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/544b33bc1d9fd630e8b81166cfed515a4abc42096844ef034bd6e542105ea971"}
{"level":"info","ts":"2026-07-27T20:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a99775b8d65552d76b9f7dc797653a76972563156274ec42ccfc9332d9735960"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c40831775f9e9b9e44ac523cec17ff38509de1ab00f5cf2ac1773e7167970dc8"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb8880c3497b55309be61a9a626a68eccae4c5177cb75b11ae119e0b7a2968d8"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94acd85db1b48e1086c1847f89ddb73222c803a77949bad017fd437ded189b73"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fdab4ba6696f98e12c5b9b6a641b81330d8672651e84b7d7be0d0d3b5ef8e841"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fc7ffc44b235b0efe6752e0674c8ea9d26396ef646499f5666f0bede4367512"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c07aa1e15cdca16b370ff721bdcdb7942d0fae2a5a3e9a6159d8d0dc70c44b9c"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da88417448f5877b672762952a6e89f22d7e27d201abdcdce625eaafa5782b1b"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6cdc6dbd00a199d8accf61023daeae19e950fc74887c812c9f1b4f7f3af2fdd"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/37181e19c6c7b9378085e7c9c0847b2b453c7eb86f43df4c48a7cc12b6c4922b"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c9b0bbf3e335bd5c8dcbf05298140cafb2cc964c2ccd34cdb265455d461fe0e4"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/812245f5ef31040699db3cbfd5101fc1a25ebd8d0fd71e844a181bf05dee699d"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d0e74ee7433c710f7ad8219a6fb8881b9833f869e71871b328aba4823fb84d7"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51f65c2dd07dff447b5b29d8c00c8579454d4eb057c22c7ecb2af6702dd3bc3e"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f33843b41e38e58867c36aea92615a708e74dfacd996984a7f604bade8027ed7"}
{"level":"info","ts":"2026-07-27T20:16:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/263a212b48ce5d0082e54a6faa00c6b88d041a5b25a6739cc9d7445a3ea2672b"}
{"level":"info","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43940","PortSpecifier":{"PortValue":43940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43940","PortSpecifier":{"PortValue":43940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183417,"nanos":894067318},"http":{"id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","method":"POST","headers":{":authority":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"642f2e95-5a2f-4660-8fde-061cac2f83ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43946","PortSpecifier":{"PortValue":43946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:43946","PortSpecifier":{"PortValue":43946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183417,"nanos":941010858},"http":{"id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","method":"POST","headers":{":authority":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1AqVQHLgLLCQbQATW_elaRUTme2qiHeaZ5Re9WmaasusrRNIqKqcQYel27y8U"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1AqVQHLgLLCQbQATW_elaRUTme2qiHeaZ5Re9WmaasusrRNIqKqcQYel27y8U\"}"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"efa326c4-77a5-41d9-be76-69f7fb1ae3ec","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"efa326c4-77a5-41d9-be76-69f7fb1ae3ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"efa326c4-77a5-41d9-be76-69f7fb1ae3ec","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:16:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa8e5f24-c04a-4f2f-a1d8-3ee63c1ae237","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d"}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712"}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3"}
{"level":"error","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"info","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:17:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"info","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:57952","PortSpecifier":{"PortValue":57952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-018406.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:57952","PortSpecifier":{"PortValue":57952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183465,"nanos":686542444},"http":{"id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","method":"POST","headers":{":authority":"e2e-ipp-a-018406.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"]}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23434e8cd72d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8e33ef3f-9fc2-41fd-8255-329c796d1c8c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"dc52eeaa-57b1-4062-9a85-d66e4f43583a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-018406.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-018406/ipp-route-018406\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-018406/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:17:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbaf94c4-9fe9-44f1-b10e-4c67f9abed54","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:57960","PortSpecifier":{"PortValue":57960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a659cbff-ff24-4974-a80f-d526c8d95394","method":"POST","path":"/ai-tenant-e2e-ipp-a-018406/ipp-route-018406/v1/chat/completions","host":"e2e-ipp-a-018406.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.21:57960","PortSpecifier":{"PortValue":57960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785183467,"nanos":750023439},"http":{"id":"a659cbff-ff24-4974-a80f-d526c8d95394","method":"POST","headers":{":authority":"e2e-ipp-a-018406.apps.6129ab3c-8fb9-4dbf-ad61-23434e8cd72d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-018406/ipp-route-018406/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dpya0QZ4dA0cOKmh_BdoB2g3TeulQapuq9kmQnV8filh2tC5TcrANZkP3tjJ"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-018406.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dpya0QZ4dA0cOKmh_BdoB2g3TeulQapuq9kmQnV8filh2tC5TcrANZkP3tjJ\"}"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-018406.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"10eea46d-d658-482e-8e3d-10b09f4a29f7","keyName":"e2e-ipp-018406","subscription":"ipp-route-018406-sub","tenant":"e2e-ipp-a-018406","userId":"10eea46d-d658-482e-8e3d-10b09f4a29f7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-018406.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-018406/ipp-route-018406\",\"requestedSubscription\":\"ipp-route-018406-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-018406.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-018406/models/facebook/opt-125m","name":"ipp-route-018406","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-018406-sub","namespace":"ai-tenant-e2e-ipp-a-018406","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-018406/ipp-route-018406"}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-018406/ipp-route-018406\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-018406/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-018406-sub"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"10eea46d-d658-482e-8e3d-10b09f4a29f7","keyName":"e2e-ipp-018406","selected_subscription":"ipp-route-018406-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-018406/ipp-route-018406-sub@ai-tenant-e2e-ipp-a-018406/ipp-route-018406","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-018406/models/facebook/opt-125m","name":"ipp-route-018406","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-018406-sub","namespace":"ai-tenant-e2e-ipp-a-018406","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-018406/ipp-route-018406"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:17:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a659cbff-ff24-4974-a80f-d526c8d95394","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7df65393160505c42cbfab6549dff63bfa51dde106d37adb5d8e57d3c173c97c"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8a7a9e5e41b76899b1dd6c64506db226df474017335aab903cbbdee0e88dd0bd"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9bbfa38e99081c497c5aa16c067156441bb28320b90b4d608e6b85d2e8baf3b2"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0e2b5ab7b2590f6bd28554212000232a122ef2bb2e6d4cde4a25be273d0b48d"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1dd6905dba21b4ce125c37815a297f961a7af3c53716659193ec37a15f3510d3"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/207ad0f7ab4783934aa87a3aef16d455360de55adf2ed2166509766c1197836f"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1f9214bad6f8a09fdc5302620a5074d5717e0664de23d0d7bce65ca1b91622a"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad781795ab5886ce9b934754c15eb18ed71498cd725cae33e224238463d04d5e"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a62ae94ad36bc6f3cf2c8f726380caf749f91242730860d3221198e2cd651a2"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1f68d3145d15c162bdd113543dc73ebe5e9b592be259d0a7b879cd868af6c8ea"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2101dfeb372cb5e934a816c66e09ae9fcb8e9c8becb625ed0e4af0085c6de712"}
{"level":"info","ts":"2026-07-27T20:18:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2dffd7389954dbee0f06be00fed8465f5c34c550066ca200d4c0939269c195a"}