--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fedcbc39-f651-49f4-9b5d-30f0da1a75ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fedcbc39-f651-49f4-9b5d-30f0da1a75ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44230","PortSpecifier":{"PortValue":44230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","method":"GET","path":"/maas-api/v1/api-keys/5ce0f77d-0c1f-4f05-8d62-0d4e08c02434","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44230","PortSpecifier":{"PortValue":44230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":242214502},"http":{"id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","method":"GET","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5ce0f77d-0c1f-4f05-8d62-0d4e08c02434",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5ce0f77d-0c1f-4f05-8d62-0d4e08c02434",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"435d1a96-8b4f-4fe6-ac29-f0d2c4d7fd55","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c93e1429-65ae-4630-af53-724695d3279c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44246","PortSpecifier":{"PortValue":44246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c93e1429-65ae-4630-af53-724695d3279c","method":"POST","path":"/maas-api/v1/api-keys/bulk-revoke","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c93e1429-65ae-4630-af53-724695d3279c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44246","PortSpecifier":{"PortValue":44246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":276134967},"http":{"id":"c93e1429-65ae-4630-af53-724695d3279c","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/bulk-revoke",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c93e1429-65ae-4630-af53-724695d3279c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:maas-admin:tester-admin-user","uid":"6844f379-bfa7-4822-b852-6a6213fc8ff6","groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=3043b2a8-6ee9-44c5-81f4-3d44a4844d42"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c93e1429-65ae-4630-af53-724695d3279c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=3043b2a8-6ee9-44c5-81f4-3d44a4844d42"]},"groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"uid":"6844f379-bfa7-4822-b852-6a6213fc8ff6","username":"system:serviceaccount:maas-admin:tester-admin-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/bulk-revoke",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c93e1429-65ae-4630-af53-724695d3279c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c93e1429-65ae-4630-af53-724695d3279c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c93e1429-65ae-4630-af53-724695d3279c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":316110409},"http":{"id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d0fb4e7-2e19-4e21-b4fb-4fae012cbeaf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6666a3b5-6f24-4d06-9403-eac0701f9811","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":352522869},"http":{"id":"6666a3b5-6f24-4d06-9403-eac0701f9811","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6666a3b5-6f24-4d06-9403-eac0701f9811","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44264","PortSpecifier":{"PortValue":44264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddf9c851-c16d-4481-a989-42da22a377f1","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44264","PortSpecifier":{"PortValue":44264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":388244172},"http":{"id":"ddf9c851-c16d-4481-a989-42da22a377f1","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddf9c851-c16d-4481-a989-42da22a377f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":425077187},"http":{"id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0d94cd7-9023-43a7-92bc-3928fa3144e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44282","PortSpecifier":{"PortValue":44282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44282","PortSpecifier":{"PortValue":44282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":461953373},"http":{"id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13c81e3d-d194-49ce-ae6b-a348d2dd0f7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44286","PortSpecifier":{"PortValue":44286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44286","PortSpecifier":{"PortValue":44286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":499187275},"http":{"id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a481b7c0-8aa7-4ce6-b7da-3e6382383f3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b751b080-22b8-4712-b60c-737187845ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44302","PortSpecifier":{"PortValue":44302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b751b080-22b8-4712-b60c-737187845ce5","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b751b080-22b8-4712-b60c-737187845ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44302","PortSpecifier":{"PortValue":44302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":534721126},"http":{"id":"b751b080-22b8-4712-b60c-737187845ce5","method":"GET","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b751b080-22b8-4712-b60c-737187845ce5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b751b080-22b8-4712-b60c-737187845ce5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b751b080-22b8-4712-b60c-737187845ce5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b751b080-22b8-4712-b60c-737187845ce5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b751b080-22b8-4712-b60c-737187845ce5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.53:47082","PortSpecifier":{"PortValue":47082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca9264ae-8774-4b5a-a281-303ac9fad097","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.53:47082","PortSpecifier":{"PortValue":47082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":550358380},"http":{"id":"ca9264ae-8774-4b5a-a281-303ac9fad097","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}},"metadata":{"subscription-info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC02ODdmZjY5OTYtbGhxdjkKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.31~maas-default-gateway-openshift-default-687ff6996-lhqv9.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ca9264ae-8774-4b5a-a281-303ac9fad097"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ca9264ae-8774-4b5a-a281-303ac9fad097","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":550358380,"seconds":1781203450},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.53:47082","port":47082}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca9264ae-8774-4b5a-a281-303ac9fad097","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1829b50c-08de-4610-95a1-501781f5faca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44314","PortSpecifier":{"PortValue":44314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1829b50c-08de-4610-95a1-501781f5faca","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1829b50c-08de-4610-95a1-501781f5faca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44314","PortSpecifier":{"PortValue":44314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":592252844},"http":{"id":"1829b50c-08de-4610-95a1-501781f5faca","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11tkA9SJMORBr1ziO_llpWX0ZlvbEmwMaP7W31E3NlCsdPBxOFnP1EgsVcFmJ"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11tkA9SJMORBr1ziO_llpWX0ZlvbEmwMaP7W31E3NlCsdPBxOFnP1EgsVcFmJ\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1829b50c-08de-4610-95a1-501781f5faca","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1829b50c-08de-4610-95a1-501781f5faca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f123779a-6cea-4dac-8e10-1e7bd3f8d2fd","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1829b50c-08de-4610-95a1-501781f5faca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1829b50c-08de-4610-95a1-501781f5faca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56a49008-7435-476d-8d47-125a93431932","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44330","PortSpecifier":{"PortValue":44330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56a49008-7435-476d-8d47-125a93431932","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56a49008-7435-476d-8d47-125a93431932","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44330","PortSpecifier":{"PortValue":44330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":626443715},"http":{"id":"56a49008-7435-476d-8d47-125a93431932","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"56a49008-7435-476d-8d47-125a93431932","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-invalid-key-12345"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"56a49008-7435-476d-8d47-125a93431932","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-invalid-key-12345\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"56a49008-7435-476d-8d47-125a93431932","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** key format","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"56a49008-7435-476d-8d47-125a93431932","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"56a49008-7435-476d-8d47-125a93431932","input":{"auth":{"identity":"Bearer **** key format","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56a49008-7435-476d-8d47-125a93431932","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"56a49008-7435-476d-8d47-125a93431932","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56a49008-7435-476d-8d47-125a93431932","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56a49008-7435-476d-8d47-125a93431932","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243b88f-3a1c-487d-9d01-75fdbceda448","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44346","PortSpecifier":{"PortValue":44346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3243b88f-3a1c-487d-9d01-75fdbceda448","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243b88f-3a1c-487d-9d01-75fdbceda448","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44346","PortSpecifier":{"PortValue":44346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":652520302},"http":{"id":"3243b88f-3a1c-487d-9d01-75fdbceda448","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-type":"application/json","forwarded":"for=44.212.242.249;host=maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC02ODdmZjY5OTYtbGhxdjkKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.31~maas-default-gateway-openshift-default-687ff6996-lhqv9.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"44.212.242.249,10.132.0.11","x-forwarded-host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-gateway-model-name":"facebook/opt-125m","x-request-id":"3243b88f-3a1c-487d-9d01-75fdbceda448"},"path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"metadata_context":{}}}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243b88f-3a1c-487d-9d01-75fdbceda448","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243b88f-3a1c-487d-9d01-75fdbceda448","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"api-keys\""},{"WWW-Authenticate":"Bearer ****
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44352","PortSpecifier":{"PortValue":44352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44352","PortSpecifier":{"PortValue":44352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":677705509},"http":{"id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baceffa6-f566-4361-9c3a-7d47044b5a5b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44366","PortSpecifier":{"PortValue":44366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44366","PortSpecifier":{"PortValue":44366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":716066213},"http":{"id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vGagP50OP03K8TPC_b963LtmtFG9z8neMGz0EKTNg6gLsfc2QpS6yF2h2s8a"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vGagP50OP03K8TPC_b963LtmtFG9z8neMGz0EKTNg6gLsfc2QpS6yF2h2s8a\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8ea10de7-2294-4bc9-8770-05a50d379e43","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7b60c65-04a2-42a4-9e11-cd79eb6b523f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"436b304a-7cca-4d05-adfb-50136519daed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44368","PortSpecifier":{"PortValue":44368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"436b304a-7cca-4d05-adfb-50136519daed","method":"DELETE","path":"/maas-api/v1/api-keys/8ea10de7-2294-4bc9-8770-05a50d379e43","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"436b304a-7cca-4d05-adfb-50136519daed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44368","PortSpecifier":{"PortValue":44368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203450,"nanos":748228821},"http":{"id":"436b304a-7cca-4d05-adfb-50136519daed","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/8ea10de7-2294-4bc9-8770-05a50d379e43",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"436b304a-7cca-4d05-adfb-50136519daed","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"436b304a-7cca-4d05-adfb-50136519daed","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/8ea10de7-2294-4bc9-8770-05a50d379e43",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"436b304a-7cca-4d05-adfb-50136519daed","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"436b304a-7cca-4d05-adfb-50136519daed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"436b304a-7cca-4d05-adfb-50136519daed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":787609633},"http":{"id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vGagP50OP03K8TPC_b963LtmtFG9z8neMGz0EKTNg6gLsfc2QpS6yF2h2s8a"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vGagP50OP03K8TPC_b963LtmtFG9z8neMGz0EKTNg6gLsfc2QpS6yF2h2s8a\"}"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** revoked or expired","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","input":{"auth":{"identity":"Bearer **** revoked or expired","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5064e2fc-2ef9-4b47-87fa-c3eb90b8c1b9","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44380","PortSpecifier":{"PortValue":44380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44380","PortSpecifier":{"PortValue":44380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":835293770},"http":{"id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11tkA9SJMORBr1ziO_llpWX0ZlvbEmwMaP7W31E3NlCsdPBxOFnP1EgsVcFmJ"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11tkA9SJMORBr1ziO_llpWX0ZlvbEmwMaP7W31E3NlCsdPBxOFnP1EgsVcFmJ\"}"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f123779a-6cea-4dac-8e10-1e7bd3f8d2fd","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37ef9e65-c66c-40a0-9b17-98a1138db9a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44384","PortSpecifier":{"PortValue":44384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44384","PortSpecifier":{"PortValue":44384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":872756368},"http":{"id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66e2dc5f-b5bc-484c-b50b-12283986ef12","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44396","PortSpecifier":{"PortValue":44396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","method":"DELETE","path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44396","PortSpecifier":{"PortValue":44396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":908921048},"http":{"id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16a00ae3-9a62-41a5-a301-1c8dbc81b030","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44400","PortSpecifier":{"PortValue":44400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a608cab1-0ec4-4ecf-906c-547065d2180e","method":"DELETE","path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44400","PortSpecifier":{"PortValue":44400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":943619912},"http":{"id":"a608cab1-0ec4-4ecf-906c-547065d2180e","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/3bd0c570-aa44-4847-b1d6-48a4e511ab80",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a608cab1-0ec4-4ecf-906c-547065d2180e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44410","PortSpecifier":{"PortValue":44410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","method":"DELETE","path":"/maas-api/v1/api-keys/nonexistent-uuid-12345","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44410","PortSpecifier":{"PortValue":44410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203452,"nanos":980674475},"http":{"id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/nonexistent-uuid-12345",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/nonexistent-uuid-12345",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b5d1e1b-9557-47ef-bb60-dc7df0d11545","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":16877984},"http":{"id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fac34f9f-66bd-4a81-ab0c-a1a7d7ef4fd3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35472e46-69ef-4115-b1a7-0930c9898d5a","method":"DELETE","path":"/maas-api/v1/api-keys/da706080-771d-47a5-8465-c790f1530cba","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":54862151},"http":{"id":"35472e46-69ef-4115-b1a7-0930c9898d5a","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/da706080-771d-47a5-8465-c790f1530cba",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/da706080-771d-47a5-8465-c790f1530cba",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35472e46-69ef-4115-b1a7-0930c9898d5a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44450","PortSpecifier":{"PortValue":44450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44450","PortSpecifier":{"PortValue":44450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":91683081},"http":{"id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a29ee9b4-a164-4c5c-bddd-2371434aa360","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44464","PortSpecifier":{"PortValue":44464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"de16522a-6b72-439c-9698-7e2d8254a4df","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44464","PortSpecifier":{"PortValue":44464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":127249984},"http":{"id":"de16522a-6b72-439c-9698-7e2d8254a4df","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5yJOG0PoT2FjhmdG_hQ00tjF9RlOvE6gFBqWYvNrCIbWNMdLiU8j2kKagdsi"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5yJOG0PoT2FjhmdG_hQ00tjF9RlOvE6gFBqWYvNrCIbWNMdLiU8j2kKagdsi\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** revoked or expired","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","input":{"auth":{"identity":"Bearer **** revoked or expired","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de16522a-6b72-439c-9698-7e2d8254a4df","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44472","PortSpecifier":{"PortValue":44472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e74f9038-0fbd-4144-9f46-25f0011c5578","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44472","PortSpecifier":{"PortValue":44472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":150384728},"http":{"id":"e74f9038-0fbd-4144-9f46-25f0011c5578","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-RF1qAWquzMaf76r7_UdyB1glxS5mg62VnHFgNwz4lzLRyQCEaCmlZw8jSdy"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-RF1qAWquzMaf76r7_UdyB1glxS5mg62VnHFgNwz4lzLRyQCEaCmlZw8jSdy\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1d83b678-cd40-4f0d-97ea-03fbc4bba21d","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e74f9038-0fbd-4144-9f46-25f0011c5578","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44482","PortSpecifier":{"PortValue":44482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44482","PortSpecifier":{"PortValue":44482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":190724525},"http":{"id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd4090df-555b-4bac-b510-aa13a3de1cbf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44488","PortSpecifier":{"PortValue":44488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44488","PortSpecifier":{"PortValue":44488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":229769899},"http":{"id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82538ef0-64ed-48b5-8813-f8ab0f109a29","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44494","PortSpecifier":{"PortValue":44494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44494","PortSpecifier":{"PortValue":44494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":267685038},"http":{"id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35bd5de6-5e7c-4c7e-b99e-9eb05720a74d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44504","PortSpecifier":{"PortValue":44504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","method":"DELETE","path":"/maas-api/v1/api-keys/500eef5d-446e-4133-9b23-3064476158ad","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44504","PortSpecifier":{"PortValue":44504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":304976857},"http":{"id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/500eef5d-446e-4133-9b23-3064476158ad",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/500eef5d-446e-4133-9b23-3064476158ad",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b23e3ae-0b39-4e15-a335-a5997f7ac17d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44520","PortSpecifier":{"PortValue":44520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12a32623-d7c3-4b10-8823-c288b01544ca","method":"DELETE","path":"/maas-api/v1/api-keys/33020167-464b-409d-bc64-3832a6aadeac","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44520","PortSpecifier":{"PortValue":44520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":342836801},"http":{"id":"12a32623-d7c3-4b10-8823-c288b01544ca","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/33020167-464b-409d-bc64-3832a6aadeac",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/33020167-464b-409d-bc64-3832a6aadeac",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12a32623-d7c3-4b10-8823-c288b01544ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa516c1d-8110-9013-9111-e547d50800dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44524","PortSpecifier":{"PortValue":44524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa516c1d-8110-9013-9111-e547d50800dd","method":"DELETE","path":"/maas-api/v1/api-keys/9b6543d4-a09f-4bb1-88ce-297d0f1e9845","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa516c1d-8110-9013-9111-e547d50800dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44524","PortSpecifier":{"PortValue":44524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":380197677},"http":{"id":"fa516c1d-8110-9013-9111-e547d50800dd","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/9b6543d4-a09f-4bb1-88ce-297d0f1e9845",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fa516c1d-8110-9013-9111-e547d50800dd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa516c1d-8110-9013-9111-e547d50800dd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/9b6543d4-a09f-4bb1-88ce-297d0f1e9845",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa516c1d-8110-9013-9111-e547d50800dd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa516c1d-8110-9013-9111-e547d50800dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa516c1d-8110-9013-9111-e547d50800dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44528","PortSpecifier":{"PortValue":44528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44528","PortSpecifier":{"PortValue":44528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":420691767},"http":{"id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7d34b18-87ff-467f-9fd9-c8cf82612c82","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44544","PortSpecifier":{"PortValue":44544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44544","PortSpecifier":{"PortValue":44544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":456522858},"http":{"id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a740903-6de8-4aa2-a1de-8989ff1f31d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44556","PortSpecifier":{"PortValue":44556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44556","PortSpecifier":{"PortValue":44556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":494645524},"http":{"id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d3fe212-89ff-4a39-aa4d-7381b6f0f394","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44558","PortSpecifier":{"PortValue":44558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44558","PortSpecifier":{"PortValue":44558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":533379294},"http":{"id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-h5n6MtiGYjtEYXYI_OBN9oQQUOKKvKCTvLd5Fd258Wl8nc7wkJLvL0c1F0zJ"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-h5n6MtiGYjtEYXYI_OBN9oQQUOKKvKCTvLd5Fd258Wl8nc7wkJLvL0c1F0zJ\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"daec68dd-7d7b-42da-9d2c-5c4795a7f73e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c93e4c0-f96d-40d6-9649-bedbe0428697","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44574","PortSpecifier":{"PortValue":44574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","method":"DELETE","path":"/maas-api/v1/api-keys/daec68dd-7d7b-42da-9d2c-5c4795a7f73e","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44574","PortSpecifier":{"PortValue":44574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":565057251},"http":{"id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/daec68dd-7d7b-42da-9d2c-5c4795a7f73e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/daec68dd-7d7b-42da-9d2c-5c4795a7f73e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b33d5eb-93d2-4d6d-bd49-69e0d04b506d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","method":"DELETE","path":"/maas-api/v1/api-keys/afee097e-ef7d-4f91-baac-1987a1b48b8b","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":601889424},"http":{"id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/afee097e-ef7d-4f91-baac-1987a1b48b8b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/afee097e-ef7d-4f91-baac-1987a1b48b8b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d383abe8-09b9-40b4-aab1-1a1dc6b1b5b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44584","PortSpecifier":{"PortValue":44584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","method":"DELETE","path":"/maas-api/v1/api-keys/367e86c5-8327-4a44-b4fa-c93872c1e51b","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44584","PortSpecifier":{"PortValue":44584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":643336407},"http":{"id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","method":"DELETE","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/367e86c5-8327-4a44-b4fa-c93872c1e51b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/367e86c5-8327-4a44-b4fa-c93872c1e51b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c76f67b-8dd7-43af-bd2d-a47c22c7a939","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44592","PortSpecifier":{"PortValue":44592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44592","PortSpecifier":{"PortValue":44592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":682086088},"http":{"id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-h5n6MtiGYjtEYXYI_OBN9oQQUOKKvKCTvLd5Fd258Wl8nc7wkJLvL0c1F0zJ"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-h5n6MtiGYjtEYXYI_OBN9oQQUOKKvKCTvLd5Fd258Wl8nc7wkJLvL0c1F0zJ\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** revoked or expired","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","input":{"auth":{"identity":"Bearer **** revoked or expired","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b0b1efe-43cf-4d04-904e-ce0b54ced965","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44598","PortSpecifier":{"PortValue":44598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44598","PortSpecifier":{"PortValue":44598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":704959697},"http":{"id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Qogm5vK4c4RkK4xA_eRe44MbwtHgjEJRZrxGu3KDKPAnoAMPmTIReHC8pWaT"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Qogm5vK4c4RkK4xA_eRe44MbwtHgjEJRZrxGu3KDKPAnoAMPmTIReHC8pWaT\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** revoked or expired","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","input":{"auth":{"identity":"Bearer **** revoked or expired","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93d8ea9f-9c83-4645-bb24-dec001c585bf","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44608","PortSpecifier":{"PortValue":44608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/completions","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44608","PortSpecifier":{"PortValue":44608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":730517006},"http":{"id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LjMxhyrTKW1O2hSm_C3kmS8IYV3Aq0RCubDnzQwoNYSA5VM4SEWVRZ1dLYXC"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LjMxhyrTKW1O2hSm_C3kmS8IYV3Aq0RCubDnzQwoNYSA5VM4SEWVRZ1dLYXC\"}"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** revoked or expired","valid":false}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"cannot fetch metadata","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"reason":"no such key: groups"}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","input":{"auth":{"identity":"Bearer **** revoked or expired","valid":false}}},"context":{"context_extensions":{"host":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea8e741c-244d-44f2-a8bf-4fb651ac3c62","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44624","PortSpecifier":{"PortValue":44624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44624","PortSpecifier":{"PortValue":44624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203453,"nanos":996032243},"http":{"id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5542caa1-88b4-4bf3-90ef-437c5ffbfd43","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44634","PortSpecifier":{"PortValue":44634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","method":"POST","path":"/maas-api/v1/api-keys/search","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44634","PortSpecifier":{"PortValue":44634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203454,"nanos":34856637},"http":{"id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5f08133-9d3b-42c1-a601-d58bc1bfac9d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44646","PortSpecifier":{"PortValue":44646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ee38600f-89c7-495d-a6d6-c22b67efc713","method":"POST","path":"/maas-api/v1/api-keys/search","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44646","PortSpecifier":{"PortValue":44646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203454,"nanos":79204224},"http":{"id":"ee38600f-89c7-495d-a6d6-c22b67efc713","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee38600f-89c7-495d-a6d6-c22b67efc713","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54879167-b3c8-48e9-95c1-33d77a070967","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44652","PortSpecifier":{"PortValue":44652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54879167-b3c8-48e9-95c1-33d77a070967","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54879167-b3c8-48e9-95c1-33d77a070967","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44652","PortSpecifier":{"PortValue":44652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203454,"nanos":119909409},"http":{"id":"54879167-b3c8-48e9-95c1-33d77a070967","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"54879167-b3c8-48e9-95c1-33d77a070967","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54879167-b3c8-48e9-95c1-33d77a070967","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54879167-b3c8-48e9-95c1-33d77a070967","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54879167-b3c8-48e9-95c1-33d77a070967","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54879167-b3c8-48e9-95c1-33d77a070967","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44668","PortSpecifier":{"PortValue":44668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","method":"GET","path":"/maas-api/v1/api-keys/b4218f7b-d4c1-42f2-a590-04c6d6494e7a","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44668","PortSpecifier":{"PortValue":44668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203454,"nanos":585315801},"http":{"id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","method":"GET","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/b4218f7b-d4c1-42f2-a590-04c6d6494e7a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"89be8d3a-f57f-4090-9852-9db60ede441d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bc45ce6b-ca5d-4a44-86ce-b3f3ceb545bc"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"89be8d3a-f57f-4090-9852-9db60ede441d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/b4218f7b-d4c1-42f2-a590-04c6d6494e7a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9953a842-d6cb-4d2f-8f29-c0d9084b9e15","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44670","PortSpecifier":{"PortValue":44670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:44670","PortSpecifier":{"PortValue":44670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203455,"nanos":342164341},"http":{"id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:llm:e2e-apikey-active-sa","uid":"75b8773c-d83a-4172-9cbb-aba9e2fd4c1d","groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7a8d49d5-4ecd-4870-a95b-2745436757e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7a8d49d5-4ecd-4870-a95b-2745436757e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"uid":"75b8773c-d83a-4172-9cbb-aba9e2fd4c1d","username":"system:serviceaccount:llm:e2e-apikey-active-sa"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:llm\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:llm:e2e-apikey-active-sa"}
{"level":"info","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21bda57d-aabb-4b35-b8df-87000ec6b39d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"error","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"error","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"info","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41064","PortSpecifier":{"PortValue":41064}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41064","PortSpecifier":{"PortValue":41064}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203474,"nanos":513620045},"http":{"id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:llm:e2e-apikey-degraded-sa","uid":"60c9db4a-c26c-4c61-8cce-eb61bc4a43f5","groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d99719f9-615a-4dc2-9361-5e2722d7b797"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d99719f9-615a-4dc2-9361-5e2722d7b797"]},"groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"uid":"60c9db4a-c26c-4c61-8cce-eb61bc4a43f5","username":"system:serviceaccount:llm:e2e-apikey-degraded-sa"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":[\"system:serviceaccount:llm:e2e-apikey-degraded-sa\"],\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:llm:e2e-apikey-degraded-sa"}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:llm\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd413c63-1d17-47cb-bb28-ca256a95fe19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"error","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"error","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:44:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:44:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"info","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43552","PortSpecifier":{"PortValue":43552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43552","PortSpecifier":{"PortValue":43552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203493,"nanos":820945104},"http":{"id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:llm:e2e-apikey-failed-sa","uid":"434b63db-5c33-4e92-9f1c-316b928af2dc","groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e0365a89-ffbd-4d02-9356-558993ebe232"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e0365a89-ffbd-4d02-9356-558993ebe232"]},"groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"uid":"434b63db-5c33-4e92-9f1c-316b928af2dc","username":"system:serviceaccount:llm:e2e-apikey-failed-sa"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":[\"system:serviceaccount:llm:e2e-apikey-failed-sa\"],\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:llm\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:llm:e2e-apikey-failed-sa"}
{"level":"info","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:44:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"223cc49d-486f-4768-b13b-2b549ba6ca2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"info","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46238","PortSpecifier":{"PortValue":46238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eebe6e9d-828a-4652-98fe-cac65c565f56","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46238","PortSpecifier":{"PortValue":46238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203513,"nanos":146772123},"http":{"id":"eebe6e9d-828a-4652-98fe-cac65c565f56","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:llm:e2e-apikey-pending-sa","uid":"f32b64bd-6d99-4538-a1c9-a1e988826500","groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b06a3fdb-1bb8-4925-87c8-815e97f9f17e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b06a3fdb-1bb8-4925-87c8-815e97f9f17e"]},"groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"uid":"f32b64bd-6d99-4538-a1c9-a1e988826500","username":"system:serviceaccount:llm:e2e-apikey-pending-sa"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":[\"system:serviceaccount:llm:e2e-apikey-pending-sa\"],\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:llm\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:llm:e2e-apikey-pending-sa"}
{"level":"info","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eebe6e9d-828a-4652-98fe-cac65c565f56","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43816","PortSpecifier":{"PortValue":43816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43816","PortSpecifier":{"PortValue":43816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1781203523,"nanos":443710860},"http":{"id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","method":"POST","headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:llm:e2e-apikey-unreconciled-sa","uid":"6f353f12-afbf-432c-9c82-325ea4a7b67c","groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d57631a4-d460-4567-821e-632a4e2b3f71"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"]}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2034b4ccc1a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d57631a4-d460-4567-821e-632a4e2b3f71"]},"groups":["system:serviceaccounts","system:serviceaccounts:llm","system:authenticated"],"uid":"6f353f12-afbf-432c-9c82-325ea4a7b67c","username":"system:serviceaccount:llm:e2e-apikey-unreconciled-sa"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":[\"system:serviceaccount:llm:e2e-apikey-pending-sa\"],\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tstartswith(request_path, \"/llm/\")\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by the /llm/ when-condition.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:llm\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:llm:e2e-apikey-unreconciled-sa"}
{"level":"info","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:45:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cc8e408-8c06-40eb-9f97-accecb4f559d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:45:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:45:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"}
{"level":"info","ts":"2026-06-11T18:45:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618"}
{"level":"debug","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:46:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:46:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"info","ts":"2026-06-11T18:47:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7bef60c3fd82a19879f06900bbc867caafc34caf5f5673426a2d0d447227bad5"}
{"level":"info","ts":"2026-06-11T18:47:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fdf03c04c54aa14a5cdf5babd19f69a45632af52488fbb81b3e313c562b9d66"}
{"level":"info","ts":"2026-06-11T18:47:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"info","ts":"2026-06-11T18:47:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-06-11T18:47:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9","issuerUrl":"https://keycloak.apps.2d7cc7b9-489b-4625-9c51-2034b4ccc1a3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-06-11T18:47:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}
{"level":"info","ts":"2026-06-11T18:47:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22badee623ae087c94cb2f74b1d8e3b7d46df07ba02c5df22fcbcde039326fc1"}
{"level":"info","ts":"2026-06-11T18:47:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f34e23a13aee8203a92ce38884671a017682f89eeb9460bae376efb811ceee2"}
{"level":"info","ts":"2026-06-11T18:47:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfd6c141375f96ba0f615a9e7c140b2588a47e69040cfe20a148f87cd43e85c9"}
{"level":"info","ts":"2026-06-11T18:47:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c967b2f645fc6176520226730813f0791c4b49ffeda6b5451b1487961b8701b9"}