{"level":"info","ts":"2026-07-15T17:44:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0830413492afedfbf079d02b4b85dc234178c9ae5e7ef4104f63173654a0a68d"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4e67d07258313660f9f53cac98407a75c2b4e363881fc74e521e31086b412ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4e67d07258313660f9f53cac98407a75c2b4e363881fc74e521e31086b412ac"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af1647267be9a7b960ab429e8ade661c8d046ac4eeb43662074e345df2777607","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af1647267be9a7b960ab429e8ade661c8d046ac4eeb43662074e345df2777607"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"13bbbb2a24ab6ae6f21ccc99957d9bc51a112068950ba178e6435484af8003d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/13bbbb2a24ab6ae6f21ccc99957d9bc51a112068950ba178e6435484af8003d4"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42cbdc85d74bb52e0b996f8227666e9339084b89a1ab916cc3befd2a141b0c95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42cbdc85d74bb52e0b996f8227666e9339084b89a1ab916cc3befd2a141b0c95"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3506934fb0f6e44f321a9caf01dc528d24ca38537d04b8e1db93dd2ab65ef45","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T17:44:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"353b3ba23bf783dc0becca495f6f06028c8521316110a995cef594369eb6bcbc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"025e035df8f85b3163dc47a028e452a0defc55d889e5dbc0ee54cf1a41ae3fc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3506934fb0f6e44f321a9caf01dc528d24ca38537d04b8e1db93dd2ab65ef45"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eca91ed7ab7a380ee5272e9a0b8a75bf3365598829168795840ef9756536e91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234e0af62b35e6ad6f2d4f89fb99702d276b9a02114709020d62cca96e0f6719","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c8f9b64ed3088b0c0b27465c18b489955a06fbf37cb515f4b8bd372ed3a61f6d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353b3ba23bf783dc0becca495f6f06028c8521316110a995cef594369eb6bcbc"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ee3fcccadb792f65bba873380f66c09780c003aa76ab958cd3ac0c687046232","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/025e035df8f85b3163dc47a028e452a0defc55d889e5dbc0ee54cf1a41ae3fc1"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ebd2911bacecd6dff6694dcd08d3192d200928a8131bbd7c106d49e2e24b3e5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c313046d2ad998fdabe7391a3e123850a816a7f99830a65545052f0a399caef3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1eca91ed7ab7a380ee5272e9a0b8a75bf3365598829168795840ef9756536e91"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234e0af62b35e6ad6f2d4f89fb99702d276b9a02114709020d62cca96e0f6719"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7940fb814b187e7286a7ec98d4e07e4b8dac1207d3c56687d9e8e75365fdf609","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73ea383bf06586677fdf18c581057d3291e10a895c71587bb407c3c5737f55f5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c8f9b64ed3088b0c0b27465c18b489955a06fbf37cb515f4b8bd372ed3a61f6d"}
{"level":"debug","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e01b0fb5abfc210cfa20466bc8712d3b2695b6fdbc93421e960966a0949993d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ee3fcccadb792f65bba873380f66c09780c003aa76ab958cd3ac0c687046232"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebd2911bacecd6dff6694dcd08d3192d200928a8131bbd7c106d49e2e24b3e5a"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c313046d2ad998fdabe7391a3e123850a816a7f99830a65545052f0a399caef3"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7940fb814b187e7286a7ec98d4e07e4b8dac1207d3c56687d9e8e75365fdf609"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ea383bf06586677fdf18c581057d3291e10a895c71587bb407c3c5737f55f5"}
{"level":"info","ts":"2026-07-15T17:44:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e01b0fb5abfc210cfa20466bc8712d3b2695b6fdbc93421e960966a0949993d"}
{"level":"info","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44086a78-807e-42ca-ad75-dfd21320d653","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:37552","PortSpecifier":{"PortValue":37552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44086a78-807e-42ca-ad75-dfd21320d653","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44086a78-807e-42ca-ad75-dfd21320d653","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:37552","PortSpecifier":{"PortValue":37552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137491,"nanos":902792294},"http":{"id":"44086a78-807e-42ca-ad75-dfd21320d653","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"44086a78-807e-42ca-ad75-dfd21320d653","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"]}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44086a78-807e-42ca-ad75-dfd21320d653","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"73ea383bf06586677fdf18c581057d3291e10a895c71587bb407c3c5737f55f5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44086a78-807e-42ca-ad75-dfd21320d653","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44086a78-807e-42ca-ad75-dfd21320d653","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44086a78-807e-42ca-ad75-dfd21320d653","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44676","PortSpecifier":{"PortValue":44676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44676","PortSpecifier":{"PortValue":44676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137491,"nanos":945771767},"http":{"id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","method":"POST","headers":{":authority":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"]}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"af1647267be9a7b960ab429e8ade661c8d046ac4eeb43662074e345df2777607"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-fadd3e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"faa2dce5-2868-4358-8d79-cbb6988d38b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:37558","PortSpecifier":{"PortValue":37558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97da8259-f35b-4e50-bb26-ea028133ef91","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:37558","PortSpecifier":{"PortValue":37558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137491,"nanos":983821590},"http":{"id":"97da8259-f35b-4e50-bb26-ea028133ef91","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk\"}"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","subscription":"e2e-rate-iso-a-b97ba8","tenant":"e2e-shared-a-0bc296","userId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-b97ba8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:44:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:44:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b97ba8"}
{"level":"debug","ts":"2026-07-15T17:44:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","selected_subscription":"e2e-rate-iso-a-b97ba8","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-b97ba8@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:44:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:44:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97da8259-f35b-4e50-bb26-ea028133ef91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46654","PortSpecifier":{"PortValue":46654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46654","PortSpecifier":{"PortValue":46654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137493,"nanos":53826881},"http":{"id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk\"}"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","subscription":"e2e-rate-iso-a-b97ba8","tenant":"e2e-shared-a-0bc296","userId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-b97ba8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b97ba8"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","selected_subscription":"e2e-rate-iso-a-b97ba8","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-b97ba8@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:44:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8d37265-c8d7-4d52-9a9b-907e298d3d71","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46670","PortSpecifier":{"PortValue":46670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46670","PortSpecifier":{"PortValue":46670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137494,"nanos":122481005},"http":{"id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PDwrPlJ7iHI3hke5_gTw7WZ1Z1AQUqUFMl6OlWzMla9aABcrYMaqIgmuiDpk\"}"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","subscription":"e2e-rate-iso-a-b97ba8","tenant":"e2e-shared-a-0bc296","userId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-b97ba8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b97ba8"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e8dcf80d-876e-4c0f-8428-b2eb5030c261","keyName":"e2e-rate-a-b97ba8","selected_subscription":"e2e-rate-iso-a-b97ba8","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-b97ba8@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b97ba8","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:44:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed17ab5-068f-4fcc-957a-b01d37b11f22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34314","PortSpecifier":{"PortValue":34314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34314","PortSpecifier":{"PortValue":34314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137502,"nanos":805929257},"http":{"id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"]}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"73ea383bf06586677fdf18c581057d3291e10a895c71587bb407c3c5737f55f5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8c07321-5a44-40b9-b502-fe9c49b48d49","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60518","PortSpecifier":{"PortValue":60518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60518","PortSpecifier":{"PortValue":60518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137502,"nanos":848950175},"http":{"id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","method":"POST","headers":{":authority":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"]}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/241c2668557b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=df463ad5-c38a-4b5e-b6de-f2403847e44e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"14f192c7-98c1-4762-b792-4c1a6c91ce60","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"af1647267be9a7b960ab429e8ade661c8d046ac4eeb43662074e345df2777607"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-fadd3e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6770d846-e6b3-4dd0-9efe-b4cfdce3af22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34328","PortSpecifier":{"PortValue":34328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34328","PortSpecifier":{"PortValue":34328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137502,"nanos":887368663},"http":{"id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e523e80e-cdd6-49d8-82f0-6c09e1294c5e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34336","PortSpecifier":{"PortValue":34336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34336","PortSpecifier":{"PortValue":34336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137503,"nanos":931699155},"http":{"id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aaf031c-e26a-4e50-88b7-8b8d385e4bb9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34346","PortSpecifier":{"PortValue":34346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c37330e-78d2-4d55-8df1-6b67625e955d","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34346","PortSpecifier":{"PortValue":34346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137504,"nanos":968420961},"http":{"id":"5c37330e-78d2-4d55-8df1-6b67625e955d","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c37330e-78d2-4d55-8df1-6b67625e955d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13249331-9023-445a-bede-b95bc939de68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34356","PortSpecifier":{"PortValue":34356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13249331-9023-445a-bede-b95bc939de68","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13249331-9023-445a-bede-b95bc939de68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34356","PortSpecifier":{"PortValue":34356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137506,"nanos":7638041},"http":{"id":"13249331-9023-445a-bede-b95bc939de68","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13249331-9023-445a-bede-b95bc939de68","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13249331-9023-445a-bede-b95bc939de68","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13249331-9023-445a-bede-b95bc939de68","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13249331-9023-445a-bede-b95bc939de68","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13249331-9023-445a-bede-b95bc939de68","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13249331-9023-445a-bede-b95bc939de68","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34364","PortSpecifier":{"PortValue":34364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34364","PortSpecifier":{"PortValue":34364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137507,"nanos":45976980},"http":{"id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57ed1e68-e4ce-417e-8707-9c0a533a5849","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34380","PortSpecifier":{"PortValue":34380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6086bfb-9863-48a1-baa6-5712438f69fd","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34380","PortSpecifier":{"PortValue":34380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137508,"nanos":85434748},"http":{"id":"b6086bfb-9863-48a1-baa6-5712438f69fd","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6086bfb-9863-48a1-baa6-5712438f69fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34396","PortSpecifier":{"PortValue":34396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34396","PortSpecifier":{"PortValue":34396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137509,"nanos":120477175},"http":{"id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"145ecad6-ad5a-4c3c-9b60-3db43c95409d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d57fd2a-3995-45d6-9239-686786117f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34398","PortSpecifier":{"PortValue":34398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d57fd2a-3995-45d6-9239-686786117f82","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d57fd2a-3995-45d6-9239-686786117f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34398","PortSpecifier":{"PortValue":34398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137510,"nanos":156735835},"http":{"id":"8d57fd2a-3995-45d6-9239-686786117f82","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d57fd2a-3995-45d6-9239-686786117f82","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d57fd2a-3995-45d6-9239-686786117f82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d57fd2a-3995-45d6-9239-686786117f82","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d57fd2a-3995-45d6-9239-686786117f82","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34412","PortSpecifier":{"PortValue":34412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34412","PortSpecifier":{"PortValue":34412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137511,"nanos":192742245},"http":{"id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43e00b64-ee6e-4ec8-80c4-131a422c929f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34414","PortSpecifier":{"PortValue":34414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:34414","PortSpecifier":{"PortValue":34414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137512,"nanos":238757655},"http":{"id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b61b90a-fe91-4aa7-930e-a1c9fd0fd734","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56124","PortSpecifier":{"PortValue":56124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","method":"POST","path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions","host":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56124","PortSpecifier":{"PortValue":56124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137513,"nanos":277825980},"http":{"id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","method":"POST","headers":{":authority":"e2e-shared-a-0bc296.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vTrLQTq30WcZJqaX_vzBRr7QWWEdlcui6rRN5y6jftYkboTLQy4hLz452DQS\"}"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","subscription":"e2e-rate-iso-a-31bbdc","tenant":"e2e-shared-a-0bc296","userId":"732df647-fd58-4a33-b594-e1c3816c3c6f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\",\"requestedSubscription\":\"e2e-rate-iso-a-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0bc296.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-0bc296/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"732df647-fd58-4a33-b594-e1c3816c3c6f","keyName":"e2e-rate-a-31bbdc","selected_subscription":"e2e-rate-iso-a-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-a-0bc296/e2e-rate-iso-a-31bbdc@ai-tenant-e2e-shared-a-0bc296/rate-test-model-0bc296","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0bc296","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31bbdc","namespace":"ai-tenant-e2e-shared-a-0bc296","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf64c67b-2de6-4215-89fd-e9e22eda6ea2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46256","PortSpecifier":{"PortValue":46256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","method":"POST","path":"/ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e/v1/completions","host":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:46256","PortSpecifier":{"PortValue":46256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784137513,"nanos":311697609},"http":{"id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","method":"POST","headers":{":authority":"e2e-shared-b-fadd3e.apps.acefb9d4-0947-4752-b221-241c2668557b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1F6lleVzRWdua33Zj_KZJhsPEral7VGM9EKmg1Kdem7hn5QuhKCYOK3BjgUPa"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-fadd3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1F6lleVzRWdua33Zj_KZJhsPEral7VGM9EKmg1Kdem7hn5QuhKCYOK3BjgUPa\"}"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-fadd3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ac93ec9-806d-46cd-a7c2-e4757065b089","keyName":"e2e-rate-b-31bbdc","subscription":"e2e-rate-iso-b-31bbdc","tenant":"e2e-shared-b-fadd3e","userId":"6ac93ec9-806d-46cd-a7c2-e4757065b089","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-fadd3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e\",\"requestedSubscription\":\"e2e-rate-iso-b-31bbdc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-fadd3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fadd3e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-31bbdc","namespace":"ai-tenant-e2e-shared-b-fadd3e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-fadd3e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-31bbdc"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ac93ec9-806d-46cd-a7c2-e4757065b089","keyName":"e2e-rate-b-31bbdc","selected_subscription":"e2e-rate-iso-b-31bbdc","selected_subscription_key":"ai-tenant-e2e-shared-b-fadd3e/e2e-rate-iso-b-31bbdc@ai-tenant-e2e-shared-b-fadd3e/rate-test-model-fadd3e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fadd3e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-31bbdc","namespace":"ai-tenant-e2e-shared-b-fadd3e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T17:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4eec241e-e2ad-4790-9c6e-623e4b9b1b21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ec0177f2ad3d9e4293247b68b079cc77c27dbd6b397dff28f03a9baf5872328"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/234e0af62b35e6ad6f2d4f89fb99702d276b9a02114709020d62cca96e0f6719"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/13bbbb2a24ab6ae6f21ccc99957d9bc51a112068950ba178e6435484af8003d4"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c3506934fb0f6e44f321a9caf01dc528d24ca38537d04b8e1db93dd2ab65ef45"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ee3fcccadb792f65bba873380f66c09780c003aa76ab958cd3ac0c687046232"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/28e01547c31d0333356f48aca8545b9dc8c3ee8ca4ae9835b5a11b07384b376c"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ebd2911bacecd6dff6694dcd08d3192d200928a8131bbd7c106d49e2e24b3e5a"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c313046d2ad998fdabe7391a3e123850a816a7f99830a65545052f0a399caef3"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/786f3ef232f1adb7bfa0a274bf5e7b6dc8010d39ee98102326778e893174828e"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e01b0fb5abfc210cfa20466bc8712d3b2695b6fdbc93421e960966a0949993d"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0830413492afedfbf079d02b4b85dc234178c9ae5e7ef4104f63173654a0a68d"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/353b3ba23bf783dc0becca495f6f06028c8521316110a995cef594369eb6bcbc"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4e67d07258313660f9f53cac98407a75c2b4e363881fc74e521e31086b412ac"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cbfb490b05e6628c58f6b9dc5688e11c56ed50e9eb32c292b8d72de6f94f86a1"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7940fb814b187e7286a7ec98d4e07e4b8dac1207d3c56687d9e8e75365fdf609"}
{"level":"info","ts":"2026-07-15T17:45:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0cfe395cbeb9d99a7ca0f442a781ed02d972a5ab2cff0e50364adda16ac8a75d"}
{"level":"info","ts":"2026-07-15T17:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/26ed1a1b5ee24d71c91cc36fb43578606e34bdbfab486cceafe13dc0a1c01eb1"}
{"level":"info","ts":"2026-07-15T17:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42cbdc85d74bb52e0b996f8227666e9339084b89a1ab916cc3befd2a141b0c95"}
{"level":"info","ts":"2026-07-15T17:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73ea383bf06586677fdf18c581057d3291e10a895c71587bb407c3c5737f55f5"}
{"level":"info","ts":"2026-07-15T17:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1eca91ed7ab7a380ee5272e9a0b8a75bf3365598829168795840ef9756536e91"}
{"level":"info","ts":"2026-07-15T17:46:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af1647267be9a7b960ab429e8ade661c8d046ac4eeb43662074e345df2777607"}
{"level":"info","ts":"2026-07-15T17:46:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8f9b64ed3088b0c0b27465c18b489955a06fbf37cb515f4b8bd372ed3a61f6d"}
{"level":"info","ts":"2026-07-15T17:46:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/025e035df8f85b3163dc47a028e452a0defc55d889e5dbc0ee54cf1a41ae3fc1"}
{"level":"info","ts":"2026-07-15T17:46:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85bd75c50afb8625792c44a5105efc19a9922bb41d8454ab4116eb6938d91ce2"}