{"level":"debug","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/daacb2c0569198360d9c95ef0e546fce403836599fc2cb96eb8ee974a1878e23"}
{"level":"info","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204"}
{"level":"info","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b"}
{"level":"info","ts":"2026-07-22T12:10:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T12:10:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"}
{"level":"error","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T12:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59004","PortSpecifier":{"PortValue":59004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6dc29b6c-1f76-44bb-a452-d0963c664915","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59004","PortSpecifier":{"PortValue":59004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722222,"nanos":947991112},"http":{"id":"6dc29b6c-1f76-44bb-a452-d0963c664915","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"]}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6dc29b6c-1f76-44bb-a452-d0963c664915","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:53366","PortSpecifier":{"PortValue":53366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:53366","PortSpecifier":{"PortValue":53366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722222,"nanos":990989100},"http":{"id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","method":"POST","headers":{":authority":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"]}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-ae7383/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a2632aa-82e8-4946-92e2-a6d2b476a0c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59016","PortSpecifier":{"PortValue":59016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6d3ea398-6474-4707-8e40-3f84082f0596","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59016","PortSpecifier":{"PortValue":59016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722223,"nanos":38678411},"http":{"id":"6d3ea398-6474-4707-8e40-3f84082f0596","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6d3ea398-6474-4707-8e40-3f84082f0596","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59024","PortSpecifier":{"PortValue":59024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"18fd91ce-9706-4386-bf32-b35c899795e3","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59024","PortSpecifier":{"PortValue":59024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722224,"nanos":109084383},"http":{"id":"18fd91ce-9706-4386-bf32-b35c899795e3","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18fd91ce-9706-4386-bf32-b35c899795e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59026","PortSpecifier":{"PortValue":59026}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a688c69-ac17-4dcf-a395-589d4867332c","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59026","PortSpecifier":{"PortValue":59026}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722225,"nanos":151764934},"http":{"id":"0a688c69-ac17-4dcf-a395-589d4867332c","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a688c69-ac17-4dcf-a395-589d4867332c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7d9772d-e733-4124-bde8-60484959edd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59040","PortSpecifier":{"PortValue":59040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7d9772d-e733-4124-bde8-60484959edd5","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7d9772d-e733-4124-bde8-60484959edd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59040","PortSpecifier":{"PortValue":59040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722226,"nanos":224291746},"http":{"id":"f7d9772d-e733-4124-bde8-60484959edd5","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7d9772d-e733-4124-bde8-60484959edd5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7d9772d-e733-4124-bde8-60484959edd5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7d9772d-e733-4124-bde8-60484959edd5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7d9772d-e733-4124-bde8-60484959edd5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b176dbd9-415c-4853-a45d-126676676bee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59050","PortSpecifier":{"PortValue":59050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b176dbd9-415c-4853-a45d-126676676bee","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b176dbd9-415c-4853-a45d-126676676bee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59050","PortSpecifier":{"PortValue":59050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722227,"nanos":264645914},"http":{"id":"b176dbd9-415c-4853-a45d-126676676bee","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b176dbd9-415c-4853-a45d-126676676bee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b176dbd9-415c-4853-a45d-126676676bee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b176dbd9-415c-4853-a45d-126676676bee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b176dbd9-415c-4853-a45d-126676676bee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54002","PortSpecifier":{"PortValue":54002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54002","PortSpecifier":{"PortValue":54002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722228,"nanos":305325340},"http":{"id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f76f9124-3931-4475-a4ab-f7635afb5ff7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7251192f-5d30-4995-88ed-41933505869d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54016","PortSpecifier":{"PortValue":54016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7251192f-5d30-4995-88ed-41933505869d","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7251192f-5d30-4995-88ed-41933505869d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54016","PortSpecifier":{"PortValue":54016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722229,"nanos":350797382},"http":{"id":"7251192f-5d30-4995-88ed-41933505869d","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7251192f-5d30-4995-88ed-41933505869d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7251192f-5d30-4995-88ed-41933505869d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7251192f-5d30-4995-88ed-41933505869d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7251192f-5d30-4995-88ed-41933505869d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7251192f-5d30-4995-88ed-41933505869d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7251192f-5d30-4995-88ed-41933505869d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54028","PortSpecifier":{"PortValue":54028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b7a0cac-7714-432a-a9fd-1008f1950261","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:54028","PortSpecifier":{"PortValue":54028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722230,"nanos":392755089},"http":{"id":"2b7a0cac-7714-432a-a9fd-1008f1950261","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C3q4brVOIpHokhbT_MwZKCe44qlxxgGnDfxZzt6cp4QuKuWAJsxumkcrFxab\"}"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","subscription":"e2e-rate-iso-a-e39a79","tenant":"e2e-shared-a-fc3650","userId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-e39a79\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e39a79"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de0c73e8-c9e5-4d8d-bf01-797f64f1323a","keyName":"e2e-rate-a-e39a79","selected_subscription":"e2e-rate-iso-a-e39a79","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-e39a79@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e39a79","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b7a0cac-7714-432a-a9fd-1008f1950261","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35952","PortSpecifier":{"PortValue":35952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35952","PortSpecifier":{"PortValue":35952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722239,"nanos":254065623},"http":{"id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"]}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6af600b1-c612-47c8-8e0c-3174d1b927c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:56790","PortSpecifier":{"PortValue":56790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:56790","PortSpecifier":{"PortValue":56790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722239,"nanos":299930106},"http":{"id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","method":"POST","headers":{":authority":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"]}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ce4cd8de3b6f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fd78d84b-9658-4ba7-a34f-7d5991f61fdb"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cbdae95e-9e61-446c-abe4-443996fc2df2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-ae7383/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25ea2a9f-d5f9-4998-b55e-66d57761db88","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34d9db93-29e6-44cc-a3de-d96822847210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35966","PortSpecifier":{"PortValue":35966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"34d9db93-29e6-44cc-a3de-d96822847210","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34d9db93-29e6-44cc-a3de-d96822847210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35966","PortSpecifier":{"PortValue":35966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722239,"nanos":339215714},"http":{"id":"34d9db93-29e6-44cc-a3de-d96822847210","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6\"}"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","subscription":"e2e-rate-iso-a-ffdb2d","tenant":"e2e-shared-a-fc3650","userId":"f9a5e142-263b-49e7-8703-529a5d3e6822","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-ffdb2d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"34d9db93-29e6-44cc-a3de-d96822847210","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ffdb2d"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9db93-29e6-44cc-a3de-d96822847210","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","selected_subscription":"e2e-rate-iso-a-ffdb2d","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-ffdb2d@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34d9db93-29e6-44cc-a3de-d96822847210","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34d9db93-29e6-44cc-a3de-d96822847210","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35972","PortSpecifier":{"PortValue":35972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35972","PortSpecifier":{"PortValue":35972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722240,"nanos":374236618},"http":{"id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6\"}"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","subscription":"e2e-rate-iso-a-ffdb2d","tenant":"e2e-shared-a-fc3650","userId":"f9a5e142-263b-49e7-8703-529a5d3e6822","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-ffdb2d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ffdb2d"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","selected_subscription":"e2e-rate-iso-a-ffdb2d","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-ffdb2d@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb9a969b-cc7b-4f18-8df0-15b26c3cec6c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35984","PortSpecifier":{"PortValue":35984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","method":"POST","path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions","host":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:35984","PortSpecifier":{"PortValue":35984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722241,"nanos":416025540},"http":{"id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","method":"POST","headers":{":authority":"e2e-shared-a-fc3650.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-g1tklIuG9ov2F0Uv_2TvBKyTHuGhxzlLO06Bpf3aVqlWjmmuTrQ4c3x6s7F6\"}"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","subscription":"e2e-rate-iso-a-ffdb2d","tenant":"e2e-shared-a-fc3650","userId":"f9a5e142-263b-49e7-8703-529a5d3e6822","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\",\"requestedSubscription\":\"e2e-rate-iso-a-ffdb2d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fc3650.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fc3650/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ffdb2d"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f9a5e142-263b-49e7-8703-529a5d3e6822","keyName":"e2e-rate-a-ffdb2d","selected_subscription":"e2e-rate-iso-a-ffdb2d","selected_subscription_key":"ai-tenant-e2e-shared-a-fc3650/e2e-rate-iso-a-ffdb2d@ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fc3650","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ffdb2d","namespace":"ai-tenant-e2e-shared-a-fc3650","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fc3650/rate-test-model-fc3650"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a9f191c-a3c3-450b-9550-049bd8ebed13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"654d31b2-9308-47b7-8317-bd40e9344917","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:56806","PortSpecifier":{"PortValue":56806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"654d31b2-9308-47b7-8317-bd40e9344917","method":"POST","path":"/ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383/v1/completions","host":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"654d31b2-9308-47b7-8317-bd40e9344917","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:56806","PortSpecifier":{"PortValue":56806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784722241,"nanos":453107284},"http":{"id":"654d31b2-9308-47b7-8317-bd40e9344917","method":"POST","headers":{":authority":"e2e-shared-b-ae7383.apps.4433282d-b967-4393-b95a-ce4cd8de3b6f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-giwdirTOGbdeNFc0_nEhbn6oVGf78PY0WQI8CjOzyBc755JBZAj1A2sigsKa"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-ae7383.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-giwdirTOGbdeNFc0_nEhbn6oVGf78PY0WQI8CjOzyBc755JBZAj1A2sigsKa\"}"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ae7383.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"769c58ef-e848-41d7-b496-4ba5ad3bbde8","keyName":"e2e-rate-b-ffdb2d","subscription":"e2e-rate-iso-b-ffdb2d","tenant":"e2e-shared-b-ae7383","userId":"769c58ef-e848-41d7-b496-4ba5ad3bbde8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-ae7383.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383\",\"requestedSubscription\":\"e2e-rate-iso-b-ffdb2d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ae7383.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ae7383","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ffdb2d","namespace":"ai-tenant-e2e-shared-b-ae7383","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383"}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"654d31b2-9308-47b7-8317-bd40e9344917","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-ae7383/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-ffdb2d"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"654d31b2-9308-47b7-8317-bd40e9344917","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"769c58ef-e848-41d7-b496-4ba5ad3bbde8","keyName":"e2e-rate-b-ffdb2d","selected_subscription":"e2e-rate-iso-b-ffdb2d","selected_subscription_key":"ai-tenant-e2e-shared-b-ae7383/e2e-rate-iso-b-ffdb2d@ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ae7383","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ffdb2d","namespace":"ai-tenant-e2e-shared-b-ae7383","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-ae7383/rate-test-model-ae7383"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"654d31b2-9308-47b7-8317-bd40e9344917","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T12:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"654d31b2-9308-47b7-8317-bd40e9344917","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T12:10:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e36396cd11f36f03c03c6315faefe2f06803c48d1c301d6cf0dee4beaa6c20a5"}
{"level":"info","ts":"2026-07-22T12:10:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2e8af9adf3c56d00d0f3e92d854fdb3fa6e2717d52e6c974d2cce4be0c5c518"}
{"level":"info","ts":"2026-07-22T12:10:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b63081c07a5d1e887dd90e95d24e2fcbd87151ffc2ae93781f772ddfdc12d4be"}
{"level":"info","ts":"2026-07-22T12:10:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62da7bf7c55d7200b259e0272326c94c1eba4faaeb25232e74d27b193ef29817"}
{"level":"info","ts":"2026-07-22T12:10:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42d99a4a590b157dddf4e09d1a1cb003a3eaf25b01c6667a85a55d05231a7b63"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/70160f140eee8dde571360786a9d43ce30f5834877024c5282f296448a4aaab6"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b570a80494273f1bb8adf78c3ea25882e1708a172f065a9faa54789aea6fa775"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7561b7ca829c4f7eb8871e8c09a1b7bca3cef98f89395858910cc7e148aaa4d"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e7de532a592efb621cf35e2636988d464630215b916f939ff26ce41e529b69e"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f8a447fcca2b2fa750731e59d7171b9b9daed6567a76a38b78bd8a8b80ee5ff"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c74b8577eab6241d15105903cc80f574b2dcacbaf76a2c627b4884fbd74790ce"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0fac2b614e0a568df386cce02d56f5a3c3038bc4ce884f658e310b790093152b"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f61e900802bcae4b85c49d6f3788d2c7f8ca030e162adba0e6f8bd5fdf8be579"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d4d98644c63e808c57625e078a4c1ffec1c8ace5a89425793b9a1c7b8e33c8b"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73b6de24d0e881728d64db205c06c7d4cba8726159fabab0af47c2b09afd224a"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/daacb2c0569198360d9c95ef0e546fce403836599fc2cb96eb8ee974a1878e23"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b302527fef15c8ddfca3aad9948dfb5de49200dd60af35042afd311c3f71a411"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4535f9ab06da98c21f3f103741ff115a76134450230af9cc8dee6be9110a204"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/acea180d734b845d6a62092e9f51feab1d0290116afcb209f0976713daf09701"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/725499a94ebb4fb3c8c9cfade49f852b2a4111dc351da42cc1a9389994d58c9b"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e85d7186bc9996c28100569e0ed7f71de0db769baf629586f21cc60c9c2bb6fd"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51249372a8efc1de52ed44df8a4bbb9d749623ae49a7c5c0abd860ede24e95cc"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81d8e7016421688ecaacb87b177d175df1874f8530d1405e66ec2662f17f02c0"}
{"level":"info","ts":"2026-07-22T12:10:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9da63d825585ebe40c82594e82d5e240cfeafabe0b32a70d61927a0d9806c40"}