{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"error","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43"}
{"level":"info","ts":"2026-07-22T17:26:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T17:26:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"}
{"level":"error","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T17:26:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35130","PortSpecifier":{"PortValue":35130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35130","PortSpecifier":{"PortValue":35130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741202,"nanos":439972188},"http":{"id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"aa191b50-9a71-45b6-a80c-f687774087cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"]}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"aa191b50-9a71-45b6-a80c-f687774087cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48d2d01f-ae40-468a-a01c-29324f9cd2a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36064","PortSpecifier":{"PortValue":36064}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4c49099-ca66-4325-a584-5acc0df02ffc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36064","PortSpecifier":{"PortValue":36064}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741202,"nanos":477031868},"http":{"id":"c4c49099-ca66-4325-a584-5acc0df02ffc","method":"POST","headers":{":authority":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"aa191b50-9a71-45b6-a80c-f687774087cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"]}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"aa191b50-9a71-45b6-a80c-f687774087cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-05e61d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4c49099-ca66-4325-a584-5acc0df02ffc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35134","PortSpecifier":{"PortValue":35134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35134","PortSpecifier":{"PortValue":35134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741202,"nanos":519987324},"http":{"id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO\"}"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","subscription":"e2e-rate-iso-a-348701","tenant":"e2e-shared-a-629c13","userId":"d98a066f-bd58-4860-b763-2766304431f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-348701\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-348701"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","selected_subscription":"e2e-rate-iso-a-348701","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-348701@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439c375c-8b99-4b0d-8d14-f1e17555c98f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41932","PortSpecifier":{"PortValue":41932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"21c109a5-797a-4c0b-a929-7a69c821357e","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41932","PortSpecifier":{"PortValue":41932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741203,"nanos":584115298},"http":{"id":"21c109a5-797a-4c0b-a929-7a69c821357e","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO\"}"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","subscription":"e2e-rate-iso-a-348701","tenant":"e2e-shared-a-629c13","userId":"d98a066f-bd58-4860-b763-2766304431f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-348701\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-348701"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","selected_subscription":"e2e-rate-iso-a-348701","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-348701@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21c109a5-797a-4c0b-a929-7a69c821357e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41946","PortSpecifier":{"PortValue":41946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41946","PortSpecifier":{"PortValue":41946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741204,"nanos":628559170},"http":{"id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UoTTQIY6oQ57WhQu_VfmhvwNS1Fa3ZJXZc60qeOOYYP4vDQZ8nOhi6PqtbYO\"}"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","subscription":"e2e-rate-iso-a-348701","tenant":"e2e-shared-a-629c13","userId":"d98a066f-bd58-4860-b763-2766304431f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-348701\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-348701"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d98a066f-bd58-4860-b763-2766304431f8","keyName":"e2e-rate-a-348701","selected_subscription":"e2e-rate-iso-a-348701","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-348701@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-348701","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30b0e2b6-d5b7-456e-be1b-1e6928a3c974","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54252","PortSpecifier":{"PortValue":54252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54252","PortSpecifier":{"PortValue":54252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741213,"nanos":362305528},"http":{"id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"aa191b50-9a71-45b6-a80c-f687774087cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"]}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"aa191b50-9a71-45b6-a80c-f687774087cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c1af424-32d8-4b2f-ae70-1c8a80bcc0a2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52234","PortSpecifier":{"PortValue":52234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52234","PortSpecifier":{"PortValue":52234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741213,"nanos":396788373},"http":{"id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","method":"POST","headers":{":authority":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"aa191b50-9a71-45b6-a80c-f687774087cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"]}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3bc22f15a725"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a27bbe23-d2d6-4d77-b29f-f8c1d4661fd2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"aa191b50-9a71-45b6-a80c-f687774087cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-05e61d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b30eb348-ecd4-46f2-a671-7a4cfd499b34","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20825957-6fb9-44da-a7b3-883347b6763f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54264","PortSpecifier":{"PortValue":54264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20825957-6fb9-44da-a7b3-883347b6763f","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20825957-6fb9-44da-a7b3-883347b6763f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54264","PortSpecifier":{"PortValue":54264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741213,"nanos":432204771},"http":{"id":"20825957-6fb9-44da-a7b3-883347b6763f","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20825957-6fb9-44da-a7b3-883347b6763f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20825957-6fb9-44da-a7b3-883347b6763f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20825957-6fb9-44da-a7b3-883347b6763f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20825957-6fb9-44da-a7b3-883347b6763f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6768aa45-4555-4426-9711-498cd03d2204","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54278","PortSpecifier":{"PortValue":54278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6768aa45-4555-4426-9711-498cd03d2204","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6768aa45-4555-4426-9711-498cd03d2204","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54278","PortSpecifier":{"PortValue":54278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741214,"nanos":463421156},"http":{"id":"6768aa45-4555-4426-9711-498cd03d2204","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6768aa45-4555-4426-9711-498cd03d2204","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6768aa45-4555-4426-9711-498cd03d2204","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6768aa45-4555-4426-9711-498cd03d2204","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6768aa45-4555-4426-9711-498cd03d2204","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54294","PortSpecifier":{"PortValue":54294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54294","PortSpecifier":{"PortValue":54294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741215,"nanos":498015009},"http":{"id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff6dbc23-c52c-495e-8c51-05af9ff7983a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16a4f5f2-c27e-4bf7-b260-96a366003685","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741216,"nanos":530918037},"http":{"id":"16a4f5f2-c27e-4bf7-b260-96a366003685","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16a4f5f2-c27e-4bf7-b260-96a366003685","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54298","PortSpecifier":{"PortValue":54298}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54298","PortSpecifier":{"PortValue":54298}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741217,"nanos":567263414},"http":{"id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70b7d1e7-f250-4d33-8e7c-a0e44996ff3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54314","PortSpecifier":{"PortValue":54314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54314","PortSpecifier":{"PortValue":54314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741218,"nanos":612964288},"http":{"id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ad7fbe8-fb03-4b08-b1a1-9221df66cd32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d7bce42-7329-45b6-8566-698841175808","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54328","PortSpecifier":{"PortValue":54328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d7bce42-7329-45b6-8566-698841175808","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d7bce42-7329-45b6-8566-698841175808","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54328","PortSpecifier":{"PortValue":54328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741219,"nanos":649504498},"http":{"id":"9d7bce42-7329-45b6-8566-698841175808","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d7bce42-7329-45b6-8566-698841175808","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d7bce42-7329-45b6-8566-698841175808","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d7bce42-7329-45b6-8566-698841175808","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d7bce42-7329-45b6-8566-698841175808","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d7bce42-7329-45b6-8566-698841175808","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:26:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d7bce42-7329-45b6-8566-698841175808","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd6dc71e-4895-997d-acdf-86330dab87c8","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741220,"nanos":691661666},"http":{"id":"fd6dc71e-4895-997d-acdf-86330dab87c8","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:27:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd6dc71e-4895-997d-acdf-86330dab87c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997823bd-ec75-4472-b724-be4240ce43f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54360","PortSpecifier":{"PortValue":54360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"997823bd-ec75-4472-b724-be4240ce43f2","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997823bd-ec75-4472-b724-be4240ce43f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:54360","PortSpecifier":{"PortValue":54360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741221,"nanos":722108812},"http":{"id":"997823bd-ec75-4472-b724-be4240ce43f2","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"997823bd-ec75-4472-b724-be4240ce43f2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997823bd-ec75-4472-b724-be4240ce43f2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997823bd-ec75-4472-b724-be4240ce43f2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:27:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997823bd-ec75-4472-b724-be4240ce43f2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41870","PortSpecifier":{"PortValue":41870}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"941d97b6-959e-4f9c-882a-f4a09336667b","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41870","PortSpecifier":{"PortValue":41870}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741222,"nanos":753120559},"http":{"id":"941d97b6-959e-4f9c-882a-f4a09336667b","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:27:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"941d97b6-959e-4f9c-882a-f4a09336667b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41874","PortSpecifier":{"PortValue":41874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","method":"POST","path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions","host":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41874","PortSpecifier":{"PortValue":41874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741223,"nanos":785230872},"http":{"id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","method":"POST","headers":{":authority":"e2e-shared-a-629c13.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5xkxfQWFxH2ZmZGU_LF4M0cqGdmRBVDELVUXc1Wa04zHWxpFO4WjpcvJv1AI\"}"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","subscription":"e2e-rate-iso-a-085652","tenant":"e2e-shared-a-629c13","userId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\",\"requestedSubscription\":\"e2e-rate-iso-a-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-629c13.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-629c13/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-085652"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9a84049a-27ef-4c7e-9d6b-a87ebbe3e926","keyName":"e2e-rate-a-085652","selected_subscription":"e2e-rate-iso-a-085652","selected_subscription_key":"ai-tenant-e2e-shared-a-629c13/e2e-rate-iso-a-085652@ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-629c13","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-085652","namespace":"ai-tenant-e2e-shared-a-629c13","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-629c13/rate-test-model-629c13"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd4eee5b-2f5b-4c43-af70-e2252c881b6f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34930","PortSpecifier":{"PortValue":34930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","method":"POST","path":"/ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d/v1/completions","host":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34930","PortSpecifier":{"PortValue":34930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784741223,"nanos":817308516},"http":{"id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","method":"POST","headers":{":authority":"e2e-shared-b-05e61d.apps.5e6bfd5d-22e5-4be1-9286-3bc22f15a725.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-R8cII4L1b5Rt8PvV_be8KbC6mrCKYQL2yX7QHCS2nN1Te6Eg4isdu0EAA7fJ"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-05e61d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-R8cII4L1b5Rt8PvV_be8KbC6mrCKYQL2yX7QHCS2nN1Te6Eg4isdu0EAA7fJ\"}"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-05e61d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4b66438e-3133-4e2d-8430-0c26acadbda9","keyName":"e2e-rate-b-085652","subscription":"e2e-rate-iso-b-085652","tenant":"e2e-shared-b-05e61d","userId":"4b66438e-3133-4e2d-8430-0c26acadbda9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-05e61d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d\",\"requestedSubscription\":\"e2e-rate-iso-b-085652\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-05e61d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-05e61d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-085652","namespace":"ai-tenant-e2e-shared-b-05e61d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d"}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-05e61d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-085652"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4b66438e-3133-4e2d-8430-0c26acadbda9","keyName":"e2e-rate-b-085652","selected_subscription":"e2e-rate-iso-b-085652","selected_subscription_key":"ai-tenant-e2e-shared-b-05e61d/e2e-rate-iso-b-085652@ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-05e61d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-085652","namespace":"ai-tenant-e2e-shared-b-05e61d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-05e61d/rate-test-model-05e61d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T17:27:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ded0053-b7c4-4e4b-8bfe-089b4b237982","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/011220f00c7e0863f7ed7958f60ea21e0caef5624187f3669351301cd14d8a11"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b71c352b91a201284095b5e9a7eaafc8c76880d8cdf29020623d0e558980dd0"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/69b398e0386baaa2bae7946cd34e5f48eb97ae2b4880cc56273ba4a86759ac8e"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0753038d1e0999294558fdf1fb52142308868a394b23b5d5091294d61ee5ba5b"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e03591e23696f7ba9be69ace1d51e0c9dc4b8492d0a76c9db08ba4c66356c38f"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02989cb6bfab03e2d16bc2c25f3db3971f53eb30bb3e17a2cb622346b38a0e6d"}
{"level":"info","ts":"2026-07-22T17:27:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5441ce8b776d61f060a71bfd793fbbd636dd2a4c52de0b4f5a9902511e4593f5"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f2ac063dcd44c8007de146769ef13a97c3c1a80ac6f514c976d5d6840f58fa6"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8f654f7c47bf8202d2abf2cd3410112dda780578634576046d0ccb2d37cef2b"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec361b85457bf1ebfb2bdf882008ec906e24053543b8660f8c9b0acbaacaf86a"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b4277cb3c012439246209d13f1e2c7c3b7b1895fe9e8e43082936d312b8a9dd5"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7454d59d114079e109f7e74a008938b55146ba4d0af729e9dd6e117029f52eef"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff94f24d2297b528201790dfd01b64694d1357f66ba3bbb0eb4d6d6af2bf9a9a"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7aca6e649dea7f0e8200968e003a4320b63092bf5c7bc936b4c46c142061573d"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b462ac4037a2598d1def2995014f2a00e50bc61854b0a765a9cf3805e85d05ad"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b1c116df5d6d18510b893385ed450746118adaae0546fd1346c57bc63bf99c1"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1233182ba9425ebbb6a753f73e2b2c6f127726fe817ecdd005590c45fec4dbb0"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e517b6f4c3c8295736c21bd680488281d4c1c81bd9fb359233c7f359d5ae339e"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ace62aeae41dacadc4d101ffbb9826a14b5c5b890b6a0d676fae74fa8d60c657"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/48728c384f26129be68abc4ba7e89e701b04343aa6a9d605967a3028d4da5485"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e934cfc2655a4e69ba3c4eab087d5f27ed816a618d8b69ed45a75e5398dd4228"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/38cc7bb4ec32ee2a272f7b8cda12bcfdfe6427bab74849e13c0c69b00c2ae07c"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f856159b77c5d7f9e5850139c3318ab1a0ea553f5aab80bed19150fff49fbd43"}
{"level":"info","ts":"2026-07-22T17:27:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f1f64a35082b2b320cad8666fb6251d1faad910064c24adf234709c64971e44"}