{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211"}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d"}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9"}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211"}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d"}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9"}
{"level":"debug","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33"}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd"}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T01:04:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"}
{"level":"error","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T01:04:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57964","PortSpecifier":{"PortValue":57964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e85d294-0945-4161-bec6-62a2070e0fbb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57964","PortSpecifier":{"PortValue":57964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768675,"nanos":338631954},"http":{"id":"7e85d294-0945-4161-bec6-62a2070e0fbb","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"]}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e85d294-0945-4161-bec6-62a2070e0fbb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52082","PortSpecifier":{"PortValue":52082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52082","PortSpecifier":{"PortValue":52082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768675,"nanos":379721548},"http":{"id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","method":"POST","headers":{":authority":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"]}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.74:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-75b665/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b313714d-5c99-4a9d-9eb7-55592de7e4a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57980","PortSpecifier":{"PortValue":57980}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57980","PortSpecifier":{"PortValue":57980}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768675,"nanos":423326353},"http":{"id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat\"}"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","subscription":"e2e-rate-iso-a-63e533","tenant":"e2e-shared-a-b90c57","userId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-63e533\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-63e533"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","selected_subscription":"e2e-rate-iso-a-63e533","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-63e533@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9f9b23-0335-480f-9b03-d52d05eaaa50","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57996","PortSpecifier":{"PortValue":57996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57996","PortSpecifier":{"PortValue":57996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768676,"nanos":489346371},"http":{"id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat\"}"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","subscription":"e2e-rate-iso-a-63e533","tenant":"e2e-shared-a-b90c57","userId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-63e533\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-63e533"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","selected_subscription":"e2e-rate-iso-a-63e533","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-63e533@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d2971e7-0fe4-490d-b976-ae05258b8d68","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:58006","PortSpecifier":{"PortValue":58006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:58006","PortSpecifier":{"PortValue":58006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768677,"nanos":528234799},"http":{"id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p8f2dYVOG7NhDVgy_BOtWMwWYKt5hPs1EJVFskfr8OjoBaVVTx95ctJl8Pat\"}"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","subscription":"e2e-rate-iso-a-63e533","tenant":"e2e-shared-a-b90c57","userId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-63e533\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-63e533"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad5e00f0-aba5-4887-828e-090bb1d235e4","keyName":"e2e-rate-a-63e533","selected_subscription":"e2e-rate-iso-a-63e533","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-63e533@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-63e533","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90f378de-779b-47ec-abd7-5d4acc3a59e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38268","PortSpecifier":{"PortValue":38268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38268","PortSpecifier":{"PortValue":38268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768686,"nanos":315717250},"http":{"id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"]}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"428f6ded-7aa4-4dd1-bcf8-2aae72b87df6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"412c7db7-1794-4135-ae18-f868caaad34d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44186","PortSpecifier":{"PortValue":44186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"412c7db7-1794-4135-ae18-f868caaad34d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"412c7db7-1794-4135-ae18-f868caaad34d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44186","PortSpecifier":{"PortValue":44186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768686,"nanos":357101976},"http":{"id":"412c7db7-1794-4135-ae18-f868caaad34d","method":"POST","headers":{":authority":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"412c7db7-1794-4135-ae18-f868caaad34d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"]}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"412c7db7-1794-4135-ae18-f868caaad34d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2152d122d342"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1634979f-3e0c-49b9-84d1-3be704043f94"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0b1e065b-68bb-4bef-b521-505a1c56658b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.74:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-75b665/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"412c7db7-1794-4135-ae18-f868caaad34d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"412c7db7-1794-4135-ae18-f868caaad34d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"412c7db7-1794-4135-ae18-f868caaad34d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38274","PortSpecifier":{"PortValue":38274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38274","PortSpecifier":{"PortValue":38274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768686,"nanos":395785863},"http":{"id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1501e505-9794-4ed3-9fbf-e1032bb2026f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38276","PortSpecifier":{"PortValue":38276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38276","PortSpecifier":{"PortValue":38276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768687,"nanos":435676446},"http":{"id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd9518f8-fcc0-4c02-a9c9-e2c1b3eeded5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38280","PortSpecifier":{"PortValue":38280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38280","PortSpecifier":{"PortValue":38280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768688,"nanos":472227436},"http":{"id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c97b5df6-d66b-4ceb-9c8d-fcf9d47ebcd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"004ae014-bca4-4027-b058-82b28eda852b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38284","PortSpecifier":{"PortValue":38284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"004ae014-bca4-4027-b058-82b28eda852b","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"004ae014-bca4-4027-b058-82b28eda852b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38284","PortSpecifier":{"PortValue":38284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768689,"nanos":514009298},"http":{"id":"004ae014-bca4-4027-b058-82b28eda852b","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"004ae014-bca4-4027-b058-82b28eda852b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004ae014-bca4-4027-b058-82b28eda852b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"004ae014-bca4-4027-b058-82b28eda852b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"004ae014-bca4-4027-b058-82b28eda852b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40282","PortSpecifier":{"PortValue":40282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40282","PortSpecifier":{"PortValue":40282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768690,"nanos":552102539},"http":{"id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9852b1c3-d3e7-4685-88f0-02d8f6bfe376","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40288","PortSpecifier":{"PortValue":40288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fc154037-bc8a-4408-98e7-0cd288d70eec","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40288","PortSpecifier":{"PortValue":40288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768691,"nanos":591114299},"http":{"id":"fc154037-bc8a-4408-98e7-0cd288d70eec","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc154037-bc8a-4408-98e7-0cd288d70eec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40292","PortSpecifier":{"PortValue":40292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d222de4-1162-4d62-b714-2e03e86a25ce","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40292","PortSpecifier":{"PortValue":40292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768692,"nanos":628376700},"http":{"id":"2d222de4-1162-4d62-b714-2e03e86a25ce","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d222de4-1162-4d62-b714-2e03e86a25ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40296","PortSpecifier":{"PortValue":40296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40296","PortSpecifier":{"PortValue":40296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768693,"nanos":664844660},"http":{"id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c901d042-ec6c-4d37-a08e-2d3dc7ac3b60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40300","PortSpecifier":{"PortValue":40300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40300","PortSpecifier":{"PortValue":40300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768694,"nanos":716453855},"http":{"id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6651228e-c0dd-44e4-88d3-3ab43aa10837","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40308","PortSpecifier":{"PortValue":40308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","method":"POST","path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions","host":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40308","PortSpecifier":{"PortValue":40308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768695,"nanos":752878327},"http":{"id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","method":"POST","headers":{":authority":"e2e-shared-a-b90c57.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bEcp4ZwPtLmYbuPX_GTbA4wYIDNgFF8m3ieiTBceK7IXw14grVVea2b9Uph4\"}"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","subscription":"e2e-rate-iso-a-eeb493","tenant":"e2e-shared-a-b90c57","userId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\",\"requestedSubscription\":\"e2e-rate-iso-a-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b90c57.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b90c57/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c8083aeb-0fa1-4245-94c0-9a196c6b46dc","keyName":"e2e-rate-a-eeb493","selected_subscription":"e2e-rate-iso-a-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-a-b90c57/e2e-rate-iso-a-eeb493@ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b90c57","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eeb493","namespace":"ai-tenant-e2e-shared-a-b90c57","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b90c57/rate-test-model-b90c57"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13098e26-bd0d-4eed-81a1-c8ed685a314d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49490","PortSpecifier":{"PortValue":49490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74264222-3f14-44f2-9201-3771e70fb0dd","method":"POST","path":"/ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665/v1/completions","host":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49490","PortSpecifier":{"PortValue":49490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768695,"nanos":787903995},"http":{"id":"74264222-3f14-44f2-9201-3771e70fb0dd","method":"POST","headers":{":authority":"e2e-shared-b-75b665.apps.5f80cff8-a40f-4de8-aac9-2152d122d342.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1YSk3fUHoxY9ucTIM_dIIf1Wl84aObaD4XywkkweZqphBVj6U95VeedpojDxC"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-75b665.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1YSk3fUHoxY9ucTIM_dIIf1Wl84aObaD4XywkkweZqphBVj6U95VeedpojDxC\"}"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-75b665.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b8f42a56-7323-4c4d-8ab6-2599e4de086c","keyName":"e2e-rate-b-eeb493","subscription":"e2e-rate-iso-b-eeb493","tenant":"e2e-shared-b-75b665","userId":"b8f42a56-7323-4c4d-8ab6-2599e4de086c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-75b665.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665\",\"requestedSubscription\":\"e2e-rate-iso-b-eeb493\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-75b665.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-75b665","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-eeb493","namespace":"ai-tenant-e2e-shared-b-75b665","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665"}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-75b665/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-eeb493"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b8f42a56-7323-4c4d-8ab6-2599e4de086c","keyName":"e2e-rate-b-eeb493","selected_subscription":"e2e-rate-iso-b-eeb493","selected_subscription_key":"ai-tenant-e2e-shared-b-75b665/e2e-rate-iso-b-eeb493@ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-75b665","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-eeb493","namespace":"ai-tenant-e2e-shared-b-75b665","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-75b665/rate-test-model-75b665"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T01:04:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74264222-3f14-44f2-9201-3771e70fb0dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0bbf6d586ec9645fe8e10205d92b90bb1d571347bb3444358fa300597eae582c"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff1909bfb49844f41dedddd5f68696845a5b0a3058f3c4e5c23de3c5520d965e"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/958e94f5dcfd6a94749fedb62429d148213a175b684eb096e318687c7b92f49c"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/327e8c8e774494002bee3f1f12f941f12ec20ccb887dd79daeef415c9d3ffd81"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52bb383d1ae5d3a45feb18e67b458354df30af243c19844ea3673f5229ef7dbd"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed8ebd3c439b7527997aeb6fc1497d2aac5070eebc3603d20b0bc29e67a7e760"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/402c3a8f2fec77b155e0767c04d3ba313977b3f1092f82b2a455a263d6622211"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2889a3c2414778bcf71d00af37bb4e5c0c483cd81c2a332e103d977f1d0cb82e"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0dfdc815077fee81c0fcaaa76c2b8692224bab1b169ad5a1a1543ffcddf7df21"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/696275b0c9130045af303efe7d3401e0e9bac8ecf02df724e3c94506667dfd88"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0475718dae616fc51d256a69fbb4eb655487c14e08a7cc62cf8dd6b11183c33"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5425c7bfd4676cbff62894de10fdc437a455d8cef28155b8ef929c09cf4a9af9"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dab845c5ac8b1c72583bce7815a7b1a4b6229226cb864667de65a6a7b1ac4b91"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aeffadd3ea4387764743db2d5787937c594382e6c76070498816e1c54814fae4"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76447b297332f2565a16cff59c2b80990e61572d50937cac854d97ea257f1d60"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/064094472d40ff5e9d842dd1375a88bb9c61adac729c64f51c833f840dfcac68"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1d9e66e29e6983ccdcba78ae608bef291fda9ee29009b10eec0a76a621f8b33"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d94bb4ce672642e026ef6fb8478193f99753685de5edb973d31d39aa42f7971"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/741980ed2b34f5dd31642fc0a63bc21e2746c2dc3381510188cb696fa061d738"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fe08b08a8669b7cd50c20da56db0a7c7858d40b9bc4e16e7ee74c63609220b4"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8fb5287ddf343f17d2640c0dd32847195352f34a078e13612eecf03a1acc0712"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1f239803e213e0e595b718c7bc784217818c89debeddfb728c803adac5f427e0"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/19c00fec71d14d4d0473b91713334166892409cd67cbca8641a0a316bce59a76"}
{"level":"info","ts":"2026-07-23T01:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ce8ec071a4e68e73beeae05fc82cf4aeb9eda21e09855cfd76f956b0de7e01d"}