{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c12742a1c3457b0740ba03497bc30c449bcafc0ee1e7821864754d7983fb4bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c12742a1c3457b0740ba03497bc30c449bcafc0ee1e7821864754d7983fb4bf"}
{"level":"debug","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e7d4229be7026ec77acf6b7c2ab16cc39cd05ea1901474bf6e5f76603e53a0fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7d4229be7026ec77acf6b7c2ab16cc39cd05ea1901474bf6e5f76603e53a0fd"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d"}
{"level":"error","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"124c0cd742d67d2983d24094b369566dd9ab6dee0fd390e23d5e5a697ff73575","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb58d1975f49b6da2194bb411ecb1b2e795b8628082ebae267b2491ef2be5ec6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T22:59:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/124c0cd742d67d2983d24094b369566dd9ab6dee0fd390e23d5e5a697ff73575"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aebc2beea2b03bde903e5fbe56d46842bde79b41719783a555a8389fb1d7a4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"901336f8fff544eb176808277134f325fe3b7f9da13d0000c7901107dbb1fd14","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb58d1975f49b6da2194bb411ecb1b2e795b8628082ebae267b2491ef2be5ec6"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aebc2beea2b03bde903e5fbe56d46842bde79b41719783a555a8389fb1d7a4a"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0066deb97641d96fd72c35f7dd73780bd00a8a8d8962cd4c714fc08ac6445609","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f1a1bd4d343633b9b8bdca6404f7aac274ebf2701d6e2b020e6f8332be7a2a75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a65fe552c83a1ae9fa4cfd8e33ce73f48fded3a830bc68c0c28d9db773e806d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4932a6d9e525a56170be5a940c0766ca321f1dac4bc583413ce4cc5e171f90cb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/901336f8fff544eb176808277134f325fe3b7f9da13d0000c7901107dbb1fd14"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed067d4856dde0f9d2d9919a347de4feb0b91a45cf69e92692bcb32b6dea71ea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0066deb97641d96fd72c35f7dd73780bd00a8a8d8962cd4c714fc08ac6445609"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eeb38f08b09940b4a17b6145866c3efcd22f9245c5cf1c995181d05b69bc2600","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b58484332816b823637df5806eb84c8f4d07774f82f54c583b5ab2fdfd5c5011","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"445563c0fa513a6ba2af6c916c67a48b50884925bcdf2b97e55736b6b4bace02","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f1a1bd4d343633b9b8bdca6404f7aac274ebf2701d6e2b020e6f8332be7a2a75"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29777dfcd72b5cee20d269d926e202f7672b48a37de2ba940d6623f8ed95826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a65fe552c83a1ae9fa4cfd8e33ce73f48fded3a830bc68c0c28d9db773e806d2"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4932a6d9e525a56170be5a940c0766ca321f1dac4bc583413ce4cc5e171f90cb"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8c12a8e22093cfd3cf27cb5513119adb61422dcf60747175c6fea49a97d385","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed067d4856dde0f9d2d9919a347de4feb0b91a45cf69e92692bcb32b6dea71ea"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2dae7f901817d9506f77927818bf6b20e4bde0e559aa8eb68086dd1e8c8704c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eeb38f08b09940b4a17b6145866c3efcd22f9245c5cf1c995181d05b69bc2600"}
{"level":"debug","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a0d193fedf5717cff20e7a2db2407efb4be2690ececef0e2600f7d2237e6b8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b58484332816b823637df5806eb84c8f4d07774f82f54c583b5ab2fdfd5c5011"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/445563c0fa513a6ba2af6c916c67a48b50884925bcdf2b97e55736b6b4bace02"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29777dfcd72b5cee20d269d926e202f7672b48a37de2ba940d6623f8ed95826a"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8c12a8e22093cfd3cf27cb5513119adb61422dcf60747175c6fea49a97d385"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2dae7f901817d9506f77927818bf6b20e4bde0e559aa8eb68086dd1e8c8704c5"}
{"level":"info","ts":"2026-07-15T22:59:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a0d193fedf5717cff20e7a2db2407efb4be2690ececef0e2600f7d2237e6b8c"}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da261bad-fd60-423f-8291-c05ac9483327","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57886","PortSpecifier":{"PortValue":57886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"da261bad-fd60-423f-8291-c05ac9483327","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da261bad-fd60-423f-8291-c05ac9483327","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57886","PortSpecifier":{"PortValue":57886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156384,"nanos":244279524},"http":{"id":"da261bad-fd60-423f-8291-c05ac9483327","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"da261bad-fd60-423f-8291-c05ac9483327","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"]}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"da261bad-fd60-423f-8291-c05ac9483327","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da261bad-fd60-423f-8291-c05ac9483327","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da261bad-fd60-423f-8291-c05ac9483327","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da261bad-fd60-423f-8291-c05ac9483327","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33858","PortSpecifier":{"PortValue":33858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1d044f0-147a-49d9-b918-90056be1ed9e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33858","PortSpecifier":{"PortValue":33858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156384,"nanos":280553292},"http":{"id":"a1d044f0-147a-49d9-b918-90056be1ed9e","method":"POST","headers":{":authority":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"]}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3f8c12a8e22093cfd3cf27cb5513119adb61422dcf60747175c6fea49a97d385"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.74:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e65bd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1d044f0-147a-49d9-b918-90056be1ed9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57900","PortSpecifier":{"PortValue":57900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57900","PortSpecifier":{"PortValue":57900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156384,"nanos":313323504},"http":{"id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh\"}"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","subscription":"e2e-rate-iso-a-38848b","tenant":"e2e-shared-a-d5b2a8","userId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-38848b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-38848b"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","selected_subscription":"e2e-rate-iso-a-38848b","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-38848b@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11965f8f-9f4d-402d-9ce3-2ce6b3b231a2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57902","PortSpecifier":{"PortValue":57902}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57902","PortSpecifier":{"PortValue":57902}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156385,"nanos":361932506},"http":{"id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh\"}"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","subscription":"e2e-rate-iso-a-38848b","tenant":"e2e-shared-a-d5b2a8","userId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-38848b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-38848b"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","selected_subscription":"e2e-rate-iso-a-38848b","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-38848b@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a6279af-96d9-48af-a94f-fbfd0aac83b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57910","PortSpecifier":{"PortValue":57910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59997765-fc82-4517-ab0a-8fd21c1e16db","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57910","PortSpecifier":{"PortValue":57910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156386,"nanos":395189323},"http":{"id":"59997765-fc82-4517-ab0a-8fd21c1e16db","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hF71YKX8cbMLrAzW_eflntWPSXSXp1ZcMQwc4Xdw1d6l8iPlR8NwiQ1NuWFh\"}"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","subscription":"e2e-rate-iso-a-38848b","tenant":"e2e-shared-a-d5b2a8","userId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-38848b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-38848b"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c392edaa-5958-45e9-b5af-a5b54b979ac4","keyName":"e2e-rate-a-38848b","selected_subscription":"e2e-rate-iso-a-38848b","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-38848b@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-38848b","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59997765-fc82-4517-ab0a-8fd21c1e16db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50888","PortSpecifier":{"PortValue":50888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50888","PortSpecifier":{"PortValue":50888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156393,"nanos":17267800},"http":{"id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"]}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"85c19f35-1c32-480a-bc6e-4b2d8cbdbf76","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33814","PortSpecifier":{"PortValue":33814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33814","PortSpecifier":{"PortValue":33814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156393,"nanos":51526803},"http":{"id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","method":"POST","headers":{":authority":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"]}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4ba8263b6ee4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b5d217e0-35e9-43b9-be1a-1b5df29f8274"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ee444cb8-b7c1-4f6f-8709-581e6b129f53","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3f8c12a8e22093cfd3cf27cb5513119adb61422dcf60747175c6fea49a97d385"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.74:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e65bd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a4c642c-369d-4877-8555-a4cc3f643f4b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50894","PortSpecifier":{"PortValue":50894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50894","PortSpecifier":{"PortValue":50894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156393,"nanos":80677357},"http":{"id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f4974b-d135-4a90-a31d-43a344f05e9c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9583942-916c-469c-95c3-1dc1154d4097","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50906","PortSpecifier":{"PortValue":50906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9583942-916c-469c-95c3-1dc1154d4097","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9583942-916c-469c-95c3-1dc1154d4097","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50906","PortSpecifier":{"PortValue":50906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156394,"nanos":109070900},"http":{"id":"f9583942-916c-469c-95c3-1dc1154d4097","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9583942-916c-469c-95c3-1dc1154d4097","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9583942-916c-469c-95c3-1dc1154d4097","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9583942-916c-469c-95c3-1dc1154d4097","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9583942-916c-469c-95c3-1dc1154d4097","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"436557d9-c957-48b1-83bd-4a253cd09441","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50908","PortSpecifier":{"PortValue":50908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"436557d9-c957-48b1-83bd-4a253cd09441","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"436557d9-c957-48b1-83bd-4a253cd09441","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50908","PortSpecifier":{"PortValue":50908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156395,"nanos":156019153},"http":{"id":"436557d9-c957-48b1-83bd-4a253cd09441","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"436557d9-c957-48b1-83bd-4a253cd09441","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436557d9-c957-48b1-83bd-4a253cd09441","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"436557d9-c957-48b1-83bd-4a253cd09441","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"436557d9-c957-48b1-83bd-4a253cd09441","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50914","PortSpecifier":{"PortValue":50914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50914","PortSpecifier":{"PortValue":50914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156396,"nanos":190871265},"http":{"id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65f87ca4-fc5e-4738-a406-3f2e891d3d7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a687812f-6d68-4804-85f0-6e7252516c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50922","PortSpecifier":{"PortValue":50922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a687812f-6d68-4804-85f0-6e7252516c14","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a687812f-6d68-4804-85f0-6e7252516c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50922","PortSpecifier":{"PortValue":50922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156397,"nanos":226128166},"http":{"id":"a687812f-6d68-4804-85f0-6e7252516c14","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a687812f-6d68-4804-85f0-6e7252516c14","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a687812f-6d68-4804-85f0-6e7252516c14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a687812f-6d68-4804-85f0-6e7252516c14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a687812f-6d68-4804-85f0-6e7252516c14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50924","PortSpecifier":{"PortValue":50924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50924","PortSpecifier":{"PortValue":50924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156398,"nanos":259123589},"http":{"id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e4f0680-4d79-4f8b-8e3e-535fa56d840c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"828a0923-61f0-475f-8918-eb50b699f91a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50926","PortSpecifier":{"PortValue":50926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"828a0923-61f0-475f-8918-eb50b699f91a","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"828a0923-61f0-475f-8918-eb50b699f91a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50926","PortSpecifier":{"PortValue":50926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156399,"nanos":297815457},"http":{"id":"828a0923-61f0-475f-8918-eb50b699f91a","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"828a0923-61f0-475f-8918-eb50b699f91a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"828a0923-61f0-475f-8918-eb50b699f91a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"828a0923-61f0-475f-8918-eb50b699f91a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T22:59:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"828a0923-61f0-475f-8918-eb50b699f91a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50930","PortSpecifier":{"PortValue":50930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9789c60-61c4-410f-aab1-56941ea4767b","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50930","PortSpecifier":{"PortValue":50930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156400,"nanos":334278422},"http":{"id":"f9789c60-61c4-410f-aab1-56941ea4767b","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T23:00:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9789c60-61c4-410f-aab1-56941ea4767b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50936","PortSpecifier":{"PortValue":50936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50936","PortSpecifier":{"PortValue":50936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156401,"nanos":368152432},"http":{"id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T23:00:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c8aff90-fb17-4aa6-a218-3a5f21b5ac87","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a74298-d5c7-4645-9376-65a5952799be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50950","PortSpecifier":{"PortValue":50950}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1a74298-d5c7-4645-9376-65a5952799be","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a74298-d5c7-4645-9376-65a5952799be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50950","PortSpecifier":{"PortValue":50950}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156402,"nanos":422094436},"http":{"id":"a1a74298-d5c7-4645-9376-65a5952799be","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1a74298-d5c7-4645-9376-65a5952799be","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a74298-d5c7-4645-9376-65a5952799be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a74298-d5c7-4645-9376-65a5952799be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T23:00:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a74298-d5c7-4645-9376-65a5952799be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c25ff5cc-b529-423f-908f-05af8221d850","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53042","PortSpecifier":{"PortValue":53042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c25ff5cc-b529-423f-908f-05af8221d850","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions","host":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c25ff5cc-b529-423f-908f-05af8221d850","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53042","PortSpecifier":{"PortValue":53042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156403,"nanos":469021449},"http":{"id":"c25ff5cc-b529-423f-908f-05af8221d850","method":"POST","headers":{":authority":"e2e-shared-a-d5b2a8.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yRTdrIM5k4s2F747_3OiL7rjsG8kZBeUD4wY3VdiQGcgbdTo6IKfu5fZC8mK\"}"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","subscription":"e2e-rate-iso-a-bd434e","tenant":"e2e-shared-a-d5b2a8","userId":"cf4fed60-6872-49d5-babb-e42ee93f4883","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\",\"requestedSubscription\":\"e2e-rate-iso-a-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b2a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c25ff5cc-b529-423f-908f-05af8221d850","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d5b2a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd434e"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25ff5cc-b529-423f-908f-05af8221d850","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cf4fed60-6872-49d5-babb-e42ee93f4883","keyName":"e2e-rate-a-bd434e","selected_subscription":"e2e-rate-iso-a-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b2a8/e2e-rate-iso-a-bd434e@ai-tenant-e2e-shared-a-d5b2a8/rate-test-model-d5b2a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b2a8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd434e","namespace":"ai-tenant-e2e-shared-a-d5b2a8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c25ff5cc-b529-423f-908f-05af8221d850","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c25ff5cc-b529-423f-908f-05af8221d850","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44246","PortSpecifier":{"PortValue":44246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","method":"POST","path":"/ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd/v1/completions","host":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44246","PortSpecifier":{"PortValue":44246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784156403,"nanos":503715155},"http":{"id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","method":"POST","headers":{":authority":"e2e-shared-b-1e65bd.apps.716a9855-ce3b-44df-a103-4ba8263b6ee4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eBOhr6ded4MhZBNk_ieQy6WMcg8Gg54IBz69rwOpkt97XwOxOcQ40pq0zVmh"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-1e65bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eBOhr6ded4MhZBNk_ieQy6WMcg8Gg54IBz69rwOpkt97XwOxOcQ40pq0zVmh\"}"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1e65bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ea0a059d-6ab7-44d3-bb93-bb122e2e5a3e","keyName":"e2e-rate-b-bd434e","subscription":"e2e-rate-iso-b-bd434e","tenant":"e2e-shared-b-1e65bd","userId":"ea0a059d-6ab7-44d3-bb93-bb122e2e5a3e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-1e65bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd\",\"requestedSubscription\":\"e2e-rate-iso-b-bd434e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1e65bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1e65bd","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bd434e","namespace":"ai-tenant-e2e-shared-b-1e65bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e65bd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-bd434e"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ea0a059d-6ab7-44d3-bb93-bb122e2e5a3e","keyName":"e2e-rate-b-bd434e","selected_subscription":"e2e-rate-iso-b-bd434e","selected_subscription_key":"ai-tenant-e2e-shared-b-1e65bd/e2e-rate-iso-b-bd434e@ai-tenant-e2e-shared-b-1e65bd/rate-test-model-1e65bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1e65bd","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bd434e","namespace":"ai-tenant-e2e-shared-b-1e65bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T23:00:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c25e04f3-e0b5-40c7-9408-af995325c1ec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T23:00:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7d4229be7026ec77acf6b7c2ab16cc39cd05ea1901474bf6e5f76603e53a0fd"}
{"level":"info","ts":"2026-07-15T23:00:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4932a6d9e525a56170be5a940c0766ca321f1dac4bc583413ce4cc5e171f90cb"}
{"level":"info","ts":"2026-07-15T23:00:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51a412bad9ec56aa9727bbf52f5551ffda48de118837484ef1b0a6fa61040d38"}
{"level":"info","ts":"2026-07-15T23:00:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f64e7e89a0c0b193a02e0a692dfc0e9c4bb4bc8e5a2a4e79def1697d3baa5f1"}
{"level":"info","ts":"2026-07-15T23:00:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2dae7f901817d9506f77927818bf6b20e4bde0e559aa8eb68086dd1e8c8704c5"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8c12742a1c3457b0740ba03497bc30c449bcafc0ee1e7821864754d7983fb4bf"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb58d1975f49b6da2194bb411ecb1b2e795b8628082ebae267b2491ef2be5ec6"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29777dfcd72b5cee20d269d926e202f7672b48a37de2ba940d6623f8ed95826a"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0066deb97641d96fd72c35f7dd73780bd00a8a8d8962cd4c714fc08ac6445609"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b58484332816b823637df5806eb84c8f4d07774f82f54c583b5ab2fdfd5c5011"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed067d4856dde0f9d2d9919a347de4feb0b91a45cf69e92692bcb32b6dea71ea"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f1a1bd4d343633b9b8bdca6404f7aac274ebf2701d6e2b020e6f8332be7a2a75"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a65fe552c83a1ae9fa4cfd8e33ce73f48fded3a830bc68c0c28d9db773e806d2"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2409624302163ee158449e057377ec8057c9a32aea85270ca9714659b753b0ce"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eeb38f08b09940b4a17b6145866c3efcd22f9245c5cf1c995181d05b69bc2600"}
{"level":"info","ts":"2026-07-15T23:00:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d093c03655a47c40f9a8a3eb6c60389bf8a238755627cdd345036335ecf003a"}
{"level":"info","ts":"2026-07-15T23:00:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/36087c57fcfbde556277c0152fd2b10e72bfd24df9886ff761dbdd1f0b23046c"}
{"level":"info","ts":"2026-07-15T23:00:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/124c0cd742d67d2983d24094b369566dd9ab6dee0fd390e23d5e5a697ff73575"}
{"level":"info","ts":"2026-07-15T23:00:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1aebc2beea2b03bde903e5fbe56d46842bde79b41719783a555a8389fb1d7a4a"}
{"level":"info","ts":"2026-07-15T23:00:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a0d193fedf5717cff20e7a2db2407efb4be2690ececef0e2600f7d2237e6b8c"}
{"level":"info","ts":"2026-07-15T23:01:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f8c12a8e22093cfd3cf27cb5513119adb61422dcf60747175c6fea49a97d385"}
{"level":"info","ts":"2026-07-15T23:01:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/445563c0fa513a6ba2af6c916c67a48b50884925bcdf2b97e55736b6b4bace02"}
{"level":"info","ts":"2026-07-15T23:01:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/901336f8fff544eb176808277134f325fe3b7f9da13d0000c7901107dbb1fd14"}
{"level":"info","ts":"2026-07-15T23:01:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97a6b65dbfcdd55b716af80d04f100bad9a7df8eabdc44471c71474f8ade262d"}